{"id":"EUVD-2026-30737","enisaUuid":"4f4e1ef8-b568-3ed1-bc71-b82626524761","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13, 11.4.x \u003c\u003d 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to {{/api/v1/meetings}}.. Mattermost Advisory ID: MMSA-2026-00608","datePublished":"May 18, 2026, 6:51:47 AM","dateUpdated":"May 18, 2026, 2:35:38 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2026-2325\nGHSA-m3p3-8frq-q7qh\n","assigner":"Mattermost","epss":0.24,"enisaIdProduct":[{"id":"3a1df563-9871-332f-a7ce-043e0b78d9f7","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"},{"id":"4f400f9b-dbd9-3ab1-b895-af3b3c1fb00d","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.4.0 ≤11.4.3"},{"id":"f0d7710c-31ae-3634-b1e3-ec62307252e0","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"}],"enisaIdVendor":[{"id":"491f291a-9a27-3941-8742-2f292d3fabec","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"02f82d55-8032-391b-a298-d8931db8ef61","vulnerability":{"id":"CVE-2026-2325","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13, 11.4.x \u003c\u003d 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to {{/api/v1/meetings}}.. Mattermost Advisory ID: MMSA-2026-00608","datePublished":"May 18, 2026, 6:51:47 AM","dateUpdated":"May 18, 2026, 2:35:38 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30737\n","assigner":"Mattermost","epss":0.24,"dataProcessed":"Nov 4, 2026, 7:15:57 AM","vulnerabilityProduct":[{"id":"1b7e4997-7502-3b2a-baa9-f7cc1f2d5c0b","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"},{"id":"c7f871ee-7d29-3781-b69c-85b9832295ac","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"},{"id":"fff5de76-0e82-3810-9f2b-21dec9803637","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.4.0 ≤11.4.3"}],"vulnerabilityVendor":[{"id":"29999c86-f539-35c6-bed1-1e1166fd4a85","vendor":{"name":"Mattermost"}}]}},{"id":"35e81258-050f-3de7-a05e-96f86038044c","vulnerability":{"id":"GHSA-m3p3-8frq-q7qh","description":"Mattermost doesn\u0027t limit the size of the request body on the start meeting API endpoint","datePublished":"May 18, 2026, 9:31:47 AM","dateUpdated":"Jun 1, 2026, 3:51:34 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-2325\nhttps://github.com/mattermost/mattermost-plugin-msteams-meetings/commit/c5892dd169de865504afa2dd02eaeb6287489f7f\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30737\n","aliases":"CVE-2026-2325\nGHSA-m3p3-8frq-q7qh\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}