Executive brief
Mattermost, a team messaging and collaboration platform, contains a flaw in its bulk reactions API endpoint that fails to limit the size of input arrays. An authenticated user can exploit this by sending crafted requests with extremely large post ID arrays, causing excessive database load and potentially degrading service availability for all users.
Technical details
The POST /api/v4/posts/ids/reactions endpoint in affected Mattermost versions fails to validate the length of the post ID array parameter, allowing authenticated attackers to submit unbounded arrays that consume excessive database resources. This is a denial-of-service vulnerability requiring valid authentication and network access to the Mattermost API. The vulnerability impacts versions 11.7.x through 11.10.x within specified patch levels.
Affected products
- Mattermost Mattermost Server 11.7.x <= 11.7.10, 11.8.x <= 11.8.5, 11.9.x <= 11.9.1, 11.10.x <= 11.10.1
Timeline
- 2026-09-22: disclosed: Security advisory published