Mattermost Updates Bound Bulk Reactions Requests
Tech GuruQuick Answer
MMSA-2026-00771 fixes an unbounded post-ID array in Mattermost's bulk reactions endpoint. An authenticated user can submit a request that creates excessive database load. Update to the fixed maintenance release for the installed stream, or a supported later release.
Confirm Scope And Apply The Supported Fix
What to do now: Record the Mattermost server branch and all application nodes, plan the supported update with database recovery available, and verify that every node leaves the affected range.
Open Mattermost security updates. The Mattermost CNA record for CVE-2026-95666 also lists the affected ranges and fixed versions.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Mattermost 11.7, 11.8, 11.9, and 11.10 release streams |
|---|---|
| Advisory | MMSA-2026-00771 |
| CVE | CVE-2026-95666 |
| Authoritative release date | MMSA publication not separately verified. Mattermost's CVE record was published 2026-09-22T13:11:13.798Z. |
| Authority revision date | MMSA revision not separately verified. CVE record updated 2026-09-22T13:57:00.428Z; this is not a verified vendor-advisory revision time. |
| Affected versions | Mattermost 11.7.0–11.7.10, 11.8.0–11.8.5, 11.9.0–11.9.1, and 11.10.0–11.10.1. |
| Fixed version | Mattermost 11.7.11, 11.8.6, 11.9.2, 11.10.2, or 11.11.0 and later supported releases |
| CVSS base score | 4.3 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | Mattermost's public CNA description does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
The vulnerable request path is POST /api/v4/posts/ids/reactions. Mattermost's CNA describes resource exhaustion with low availability impact, not unauthenticated code execution or a confidentiality breach. Its explicit solution lists 11.7.11, 11.8.6, 11.9.2, 11.10.2 and 11.11.0 or higher.
What To Validate Now
- Inventory. Locate Mattermost 11.7, 11.8, 11.9, and 11.10 release streams deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Mattermost 11.7.0–11.7.10, 11.8.0–11.8.5, 11.9.0–11.9.1, and 11.10.0–11.10.1. Do not infer applicability from product family or severity alone.
- Remediate. Apply Mattermost 11.7.11, 11.8.6, 11.9.2, 11.10.2, or 11.11.0 and later supported releases through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm running server versions across the deployment, then test normal post/reaction retrieval and monitor database load, request errors and latency. Do not run an unbounded production request as a patch check.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
