The vulnerability lies in Mattermost server versions 11.9.1 and earlier, 11.8.5 and earlier, 11.7.10 and earlier, and 11.10.1 and earlier. These releases do not enforce a request body size limit while validating CSRF tokens on plugin endpoints. An authenticated user can send a very large payload to a plugin route, causing the server to allocate memory for the request and eventually run out of memory, leading to a denial of service. This failure to enforce a size limit is a classic resource exhaustion flaw (CWE‑789).

The affected systems are Mattermost server installations running any of the vulnerable releases: 11.9.x through 11.9.1, 11.8.x through 11.8.5, 11.7.x through 11.7.10, and 11.10.x through 11.10.1.

The CVSS score of 6.5 indicates a medium severity attack that primarily impacts availability. EPSS data is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no known, active exploits. The attack vector is inferred to be through authenticated users who can reach the server; an attacker would need login credentials and the ability to construct a large request to a plugin endpoint, which is straightforward within the normal application workflow.