CVE-2026-6850

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post containing a specially crafted payload that triggers catastrophic backtracking in the client-side markdown parser.. Mattermost Advisory ID: MMSA-2026-00658

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - responsibledisclosure@mattermost.com

Published

2026-07-13

Last modified

2026-07-13

Weaknesses

CWE-1333

Affected products

• Mattermost (Mattermost)
• Mattermost Server (Mattermost)

References

• https://mattermost.com/security-updates