CVE-2026-95666

Executive Summary

CVE-2026-95666 is a resource-consumption vulnerability (CWE-770) in Mattermost that affects the bulk reactions endpoint POST /api/v4/posts/ids/reactions. The affected releases are Mattermost 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1. An authenticated user can submit a crafted request containing an oversized array of post IDs, which is not length-limited by the server, causing excessive database load and a limited availability impact. No public proof-of-concept or in-the-wild exploitation has been observed, and no patched version has been published as of this report.

Technical Analysis

The vulnerability resides in the Mattermost bulk reactions API endpoint POST /api/v4/posts/ids/reactions. According to the advisory, the server fails to limit the length of the post ID array accepted by this endpoint. This is a classic uncontrolled-resource-consumption weakness classified as CWE-770 (Allocation of Resources Without Limits or Throttling).

The attack surface is the REST API v4 endpoint, which is network-reachable (AV:N) and requires the attacker to hold a valid authenticated session with at least low privileges (PR:L). Because the endpoint accepts an array of post identifiers in the request body, an attacker can supply an arbitrarily large array. The backend presumably iterates over the array to resolve each post ID and perform reaction-related database operations. Without a cap on array cardinality, the query workload scales linearly — or potentially worse — with the number of supplied identifiers, translating a single HTTP request into a disproportionately large volume of database work.

The weakness is not a memory-safety flaw, injection vulnerability, or authentication bypass. It is purely a resource-exhaustion issue. The absence of input validation on array length allows an authenticated user to amplify a small request into heavy database load. The CVSS vector reflects this confined impact: only availability is affected (A:L), with no confidentiality (C:N) or integrity (I:N) impact, and no change to the security scope (S:U). The low attack complexity (AC:L) and no user interaction (UI:N) mean the flaw can be triggered reliably and repeatedly by any authenticated account.

No specifics about the server-side handler, the exact parameter name of the array, or the internal data-access layer are provided in the advisory. Analysis therefore remains at the vulnerability-class level — unthrottled array processing causing backend database strain. Notably, the affected version ranges span four concurrent release branches (11.7, 11.8, 11.9, 11.10), indicating a long-lived code path rather than a recently introduced regression.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-95666, and the attack chain below is inferred strictly from the vulnerability class (CWE-770 resource exhaustion) and the endpoint named in the advisory.

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-exposed Mattermost instance by fingerprinting the web client (for example via the Shodan dorks listed above) or by routine enumeration of deployed collaboration platforms. The attacker must obtain valid credentials, since the endpoint requires authentication. This could be a legitimate low-privileged account, a compromised user session token, or a guest account with API access.

2. Triggering the flaw class. With an authenticated session, the attacker issues a crafted request to POST /api/v4/posts/ids/reactions, supplying a post ID array whose length far exceeds any realistic UI-generated value. The server does not validate or cap the array length before processing it.

3. Execution method. Because no PoC is available, the precise payload structure is not detailed in the advisory. At the vulnerability-class level, the attacker simply enlarges the identifier array in the request body to force the backend to resolve and process an excessive number of entries in a single call. The request can be repeated, and the amplification factor depends on how many identifiers can be packed into one request.

4. Post-exploitation impact. Each oversized request generates excessive database load. Repeated or concurrent submissions can saturate database CPU/IO and connection pools, degrading or denying service to legitimate users across the Mattermost instance. The impact is availability-only and limited in severity per the CVSS assessment, but sustained abuse against a shared database could affect co-located services.

Impact Assessment

The CVSS 3.1 base score is 4.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. This breaks down as follows: the attack is remotely reachable over the network, requires low privileges (an authenticated account), needs no user interaction, and produces only a limited availability impact. Confidentiality and integrity are unaffected, and the exploit cannot cross a security authority boundary.

The blast radius is the Mattermost deployment itself and any downstream consumers of its backing database. Because the endpoint operates on post IDs, the database layer is the primary stress target. Organizations hosting Mattermost on shared database infrastructure should consider whether database saturation could ripple into other applications. The requirement for authentication substantially narrows the attacker population to insiders, compromised accounts, and holders of valid guest credentials.

No EPSS score has been assigned by FIRST.org, no CISA KEV listing exists, and no public exploit or Nuclei template has been observed. The practical risk is therefore moderate: real-world impact depends on whether an attacker already holds credentials and whether the target's reaction-processing code path lacks any independent rate limiting or query timeout.

Detection Guidance

Sigma Rule

title: Mattermost Bulk Reactions Oversized Post ID Array
id: 3f9a7c1e-2026-4f10-9b22-mattermostbulk
status: experimental
description: Detects excessive-length post ID arrays submitted to the Mattermost bulk reactions endpoint
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95666
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: mattermost
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/api/v4/posts/ids/reactions'
    cs-method: 'POST'
  selection_size:
    sc-bytes|gte: 50000
  condition: selection_endpoint and selection_size
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - sc-bytes
falsepositives:
  - Legitimate bulk reaction operations on very large public channels
level: medium

YARA Rule

rule CVE_2026_95666_Mattermost_Bulk_Reactions
{
    meta:
        description = "Detects oversized post ID arrays targeting the Mattermost bulk reactions endpoint"
        reference = "CVE-2026-95666"
        author = "valtersit.com"
        date = "2026-01-01"
    strings:
        $ep = "/api/v4/posts/ids/reactions"
        $id = "\"post_ids\"" nocase
        $id2 = "post_ids" nocase
    condition:
        $ep and ($id or $id2) and filesize > 20KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-95666 Mattermost Bulk Reactions Oversized Post ID Array Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v4/posts/ids/reactions"; dsize:>50000; classtype:attempted-dos; reference:cve,2026-95666; sid:202695666; rev:1;)

Elastic Detection

network where
  http.request.method == "POST" and
  stringContains(http.request.uri.path, "/api/v4/posts/ids/reactions") and
  http.request.body.bytes >= 50000

Splunk SPL Query

index=web sourcetype=mattermost_access
  uri_path="/api/v4/posts/ids/reactions" method=POST
| eval body_size=coalesce(bytes, sc_bytes, 0)
| where body_size > 50000
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip user
| where count >= 3
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="mattermost,web,attack,">
  <rule id="100966" level="8">
    <decoded_as>json</decoded_as>
    <field name="uri_path">/api/v4/posts/ids/reactions</field>
    <field name="method">POST</field>
    <description>CVE-2026-95666: Possible Mattermost bulk reactions oversized post ID array DoS attempt.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Apply request-body size limits and rate limiting at the reverse proxy, WAF, or API gateway in front of Mattermost, with particular attention to POST /api/v4/posts/ids/reactions. Enforce authentication hardening so that only trusted, necessary accounts hold interactive credentials. Monitor database CPU, connection pool utilization, and slow-query metrics for spikes correlated with requests to the bulk reactions endpoint. If bulk reactions are not operationally required, consider temporarily blocking the endpoint at the edge for non-administrative users.

2. Patch/upgrade steps. No fixed version has been published for this issue as of this report; Mattermost Advisory MMSA-2026-00771 is referenced in the advisory data. Track the Mattermost security advisories page and the GitHub security releases for updated releases covering the 11.7.x, 11.8.x, 11.9.x, and 11.10.x branches, and upgrade to the vendor-designated fixed build once available. Since patch confidence is 0/4, do not assume any current release remediates the flaw.

3. Long-term hardening. Enforce strict server-side input validation, including maximum array-length limits, on all bulk API endpoints. Introduce query timeouts and per-endpoint cost budgets at the data-access layer. Adopt API rate limiting and abuse detection for authenticated users. Periodically review API endpoints that accept client-controlled collections to identify further unthrottled resource-consumption paths.

References

• NVD — CVE-2026-95666: https://nvd.nist.gov/vuln/detail/CVE-2026-95666
• Mattermost Security Advisories (search for MMSA-2026-00771): https://mattermost.com/security-updates/
• MITRE CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• FIRST EPSS — CVE-2026-95666 (not yet scored): https://api.first.org/data/v1/epss?cve=CVE-2026-95666
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, public exploits, or exploit-in-the-wild evidence have been observed for this CVE.