CVEFinder.io

CVE-2026-10600

🔶 medium
🔍 Scan for this CVE
Summary

Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server via repeatedly uploading small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool.. Mattermost Advisory ID: MMSA-2026-00694

CVSS Score
4.3
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-07-27
First Seen: 2026-07-31
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 5.3% of all 348,695 vulnerabilities in our database.

#330,067
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 27, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
abderrahimelkahlaoui
SSVC data provided by CISA
Last Modified 2026-08-03
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE IDs (Weakness Types)
CWE-770

📦 Affected Products 4

Vendor Product Status Affected Versions
mattermost mattermost_server Affected
> 10.11.0 < 10.11.21
mattermost mattermost_server Affected
> 11.6.0 < 11.6.6
mattermost mattermost_server Affected
> 11.7.0 < 11.7.4
mattermost mattermost_server Affected
> 11.8.0 < 11.8.1

🔗 References 1

https://mattermost.com/security-updates
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-10527 🔶 medium 6.3 0.2 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a ... 2026-08-17
CVE-2026-15754 🔶 medium 4.2 0.2 Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate ... 2026-08-17
CVE-2026-16044 🔶 medium 5.4 0.2 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privile... 2026-08-17
CVE-2026-16045 🔶 medium 4.3 0.2 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and person... 2026-08-17
CVE-2026-16046 🔶 medium 4.3 0.2 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for f... 2026-08-17
CVE-2026-16047 🔶 medium 4.3 0.2 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access... 2026-08-17
These CVEs affect the same products