Description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}.. Mattermost Advisory ID: MMSA-2026-00771

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-22T14:17:21.437Z",
  "pubdate": "2026-09-22T14:17:21.437Z",
  "executiveSummary": "This vulnerability involves an improper input validation flaw within the bulk reactions endpoint of Mattermost, specifically affecting versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1.\nThe vulnerability is categorized as a Denial of Service (DoS) vector caused by resource exhaustion.\nThe core issue stems from the application's failure to enforce length constraints on the post ID array provided during a request to the /api/v4/posts/ids/reactions endpoint.\nAn authenticated attacker can exploit this lack of validation by submitting a maliciously crafted request containing a disproportionately large array of post identifiers.\nUpon processing this oversized input, the backend database is forced to perform an excessive number of lookups or operations, leading to significant CPU and memory spikes.\nThe resulting impact is an degradation of system performance or complete service unavailability for legitimate users, posing a risk to the operational continuity of the affected Mattermost instance.\nExploitation requires the attacker to hold valid user credentials, as the endpoint is protected by standard authentication mechanisms.",
  "technicalDetails": "The vulnerability resides in the request handling logic for the /api/v4/posts/ids/reactions endpoint, which is designed to retrieve reaction data for a specified set of posts provided as an array in the request body.\nThe root cause is an insufficient input validation control; the system lacks a defined threshold or maximum limit for the number of elements within the post ID array accepted by the endpoint.\nWhen a request is submitted, the API controller processes the input array without sanitizing or capping the payload size. Consequently, the backend database query builder constructs a query equivalent to 'SELECT reactions FROM posts WHERE post_id IN (...)', where the number of parameters is directly proportional to the size of the user-supplied array.\nAn attacker can exploit this by injecting a payload consisting of thousands or tens of thousands of post IDs in a single request. This forces the database engine to resolve an extensive list of identifiers, consuming high amounts of I/O, memory, and CPU cycles during the query optimization and execution phases.\nThe attack flow follows a predictable sequence: First, the attacker initiates an authenticated session with the Mattermost API. Second, the attacker crafts a POST request targeting /api/v4/posts/ids/reactions, embedding an abnormally large array of post IDs within the JSON payload. Third, the Mattermost application server receives the request and, due to the lack of input length validation, passes the entire array to the database abstraction layer. Fourth, the database enters a high-load state while attempting to process the query, potentially leading to connection pool exhaustion or query timeouts.\nBecause the database becomes bottlenecked by these heavy queries, the application becomes unable to process concurrent requests from other users, effectively causing a Denial of Service (DoS). The post-exploitation impact includes sustained degradation of the user experience and, in severe cases, the crash or non-responsiveness of the underlying database service, requiring administrative intervention to restore availability."
}