Executive brief
Mattermost, a collaboration and messaging platform, contains a vulnerability in its meeting API that fails to limit the size of incoming data requests. An authorized user could exploit this by sending a massive request to the server, potentially causing the system to crash or become unresponsive. This could disrupt business operations by making the communication platform unavailable to other users.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in Mattermost Server and the MS Teams Meetings plugin due to a lack of request body size validation on the '/api/v1/meetings' endpoint. An authenticated attacker can send a crafted, oversized HTTP POST request to this endpoint to consume excessive server memory or CPU. This can lead to a denial of service (DoS) condition. The issue is addressed in Mattermost Server versions 11.5.2, 10.11.14, and 11.4.4, and in the MS Teams Meetings plugin version 1.1.1-0.20260213105619-c5892dd169de.
Affected products
- Mattermost Mattermost Server 11.5.0 - 11.5.1, 10.11.0 - 10.11.13, 11.4.0 - 11.4.3
- Mattermost MS Teams Meetings Plugin for Mattermost < 1.1.1-0.20260213105619-c5892dd169de
Timeline
- 2026-05-18: advisory: Initial disclosure and NVD publication
- 2026-06-01: patched: GitHub advisory updated with patch details