CVE-2026-10600

MediumCVSS 4.3/10Last modified Aug 3, 2026

Description

Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server via repeatedly uploading small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool.. Mattermost Advisory ID: MMSA-2026-00694

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 11.8.0, <= 11.8.0; >= 11.7.0, <= 11.7.3; >= 11.6.0, <= 11.6.5; >= 10.11.0, <= 10.11.20

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Jul 27, 2026
Last modified: Aug 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1060005.3The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured CVE-2026-1060025.3The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-manag CVE-2026-1060035.3The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its A CVE-2026-1060045.3The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated at CVE-2026-1060075.3The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthe CVE-2026-1060085.3The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a CVE-2026-106014.3A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endp CVE-2026-1060105.3The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route an CVE-2026-1060139.8The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to CVE-2026-1060145.3The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hos CVE-2026-1060158.1The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate accou CVE-2026-1060169.8Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.