What is CVE-2026-12882?

CVE-2026-12882 is a medium-severity vulnerability in Mattermost, classified under Inefficient Algorithmic Complexity. CVSS score: 4.3/10. Published 2026-09-14.

How severe is CVE-2026-12882?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Mattermost

CVE-2026-12882

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.

Affected products

Mattermost

Weakness classification (CWE)

CWE-407 — Inefficient Algorithmic Complexity

References

responsibledisclosure@mattermost.com (vendor-advisory)

Frequently asked questions

What is CVE-2026-12882?: CVE-2026-12882 is a medium-severity vulnerability in Mattermost, classified under Inefficient Algorithmic Complexity. CVSS score: 4.3/10. Published 2026-09-14.
How severe is CVE-2026-12882?: Medium severity. CVSS v3 base score is 4.3 out of 10.