CVE-2026-12882
🔶 mediumSummary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703
CVSS Score
4.3
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-09-14
First Seen: 2026-09-16
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 5.3% of all 358,566 vulnerabilities in our database.
#339,445
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Sep 14, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
Adam Korczynski
SSVC data provided by
CISA
Last Modified
2026-09-16
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE IDs (Weakness Types)