Mattermost versions in the 11.6.x, 11.5.x, 11.4.x, and 10.11.x branches contain a concurrency flaw that prevents the server from archiving a channel before removing persistent notifications. An authenticated user can exploit this timing mismatch by creating a persistent notification just after the server deletes existing notifications and before it archives the channel, causing a crash that results in a denial of service.

The vulnerability impacts all Mattermost installations running 11.6.x up to and including 11.6.0, 11.5.x up to 11.5.3, 11.4.x to 11.4.4, and 10.11.x to 10.11.14. Versions 11.7.0, 11.6.1, 11.5.4, 11.4.5, and 10.11.15 or newer contain the fix.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available, so the exploitation likelihood is uncertain but potentially significant. The vulnerability is not included in the CISA KEV catalog. Because it requires authenticated access, the attack surface is limited to users with permission to create persistent notifications, but the impact—server crash—is critical.