CVE-2026-96260

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.10 Mattermost versions 11.8.0 through 11.8.5 Mattermost versions 11.9.0 through 11.9.1 Mattermost versions 11.10.0 through 11.10.1

Description An authenticated user can cause a denial of service by exhausting server memory. This occurs because the software fails to enforce a request body size limit during Cross-Site Request Forgery (CSRF) validation—a security mechanism used to prevent unauthorized commands from being transmitted from a user that the web application trusts—when processing requests sent to a plugin endpoint.

Recommendations Update Mattermost versions 11.7.0 through 11.7.10 to a version newer than 11.7.10. Update Mattermost versions 11.8.0 through 11.8.5 to a version newer than 11.8.5. Update Mattermost versions 11.9.0 through 11.9.1 to a version newer than 11.9.1. Update Mattermost versions 11.10.0 through 11.10.1 to a version newer than 11.10.1.