The bulk reactions endpoint in Mattermost receives an unbounded array of post IDs, which corresponds to a CWE-770 weakness involving uncontrolled resource consumption. An authenticated user can craft a request with thousands of IDs to POST /api/v4/posts/ids/reactions. The server attempts to process each ID, performing a large number of database updates that overwhelm CPU, I/O, and memory resources, eventually leading to a denial of service for legitimate users.

Mattermost self‑hosted deployments are affected. Versions 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, 11.7.x up to 11.7.10, and 11.10.x up to 11.10.1 are vulnerable. Versions 11.9.2, 11.8.6, 11.7.11, 11.10.2 and all releases beginning with 11.11.0 contain the fix.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no known active exploits. The attack vector requires authenticated access to the bulk reactions API, so the threat primarily targets administrators or compromised accounts; however, an attacker could cause significant load on the database and degrade service for all users.