The vulnerability is an improper input validation flaw in the start meeting API endpoint that does not limit the size of the request body. An attacker who has authenticated to the Mattermost server can craft an oversized HTTP POST request to /api/v1/meetings, forcing the application to consume excessive resources and eventually become unavailable. This can result in a denial of service for that particular user session.

Mattermost Mattermost versions 10.11.0 through 10.11.13, 11.4.0 through 11.4.3, and 11.5.0 through 11.5.1 are affected.

The CVSS score of 4.3 denotes a low‑to‑moderate risk, while EPSS data is not available, so the exploitation probability is unknown. The vulnerability is not listed in CISA KEV. Attackers need only an authenticated session and the ability to issue HTTP POST requests to the server; a single oversized request can trigger resource exhaustion and a denial of service once limits are exceeded.