CVE-2026-4635

Persistent notification timing attack causing server denial of service

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to archive the channel before removing persistent notifications which allows authenticated user to crash the server via timing the creation of persistent notification message between the server deleting existing persistent notifications and archiving the channel.. Mattermost Advisory ID: MMSA-2026-00637

We have discovered 99 live websites that are affected by CVE-2026-4635.

Run a Free Instant Scan



Affected Software

Product  Mattermost
Category Message Boards
Vulnerable Domains99 live websites (25% of Mattermost install base)
Vulnerable Versions
  • from 10.11 through 10.11.14
  • from 11.4 through 11.4.4
  • from 11.5 through 11.5.3
  • from 11.6 through 11.6
Vulnerable Versions Count15 versions ( 19% of all versions)


Common Weakness Enumeration

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')



Details

  • Published - May 22, 2026
  • Updated - May 22, 2026

Credits

  • daw10 (finder)

Website Distribution by Country

Number of websites using CVE-2026-4635
United States23 websites


Russia24 websites
Germany15 websites
France8 websites
Singapore6 websites
GB3 websites
Canada2 websites
Netherlands2 websites
Belgium1 websites

Website Distribution by TLD

Number of websites using CVE-2026-4635
.com23 websites
.ru23 websites
.org14 websites
.de5 websites
.net5 websites
.fr3 websites
.ch2 websites
.co.jp2 websites
.io2 websites
.be1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-4635

Top websites that are affected by CVE-2026-4635. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.****.*****.**.us United States**,***
****.*******.com GB***,***
**********.*********.org France***,***
****.*******.com Germany*,***,***
******.**********.ch Germany*,***,***
******.********.ru Russia*,***,***
*******.********.org United States*,***,***
******.de Germany*,***,***
*********.*********.cl United States*,***,***
*******************.com Singapore**,***,***
See full domain list

FAQ

CVE-2026-4635 is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Mattermost
A total of 99 websites have been identified as vulnerable to CVE-2026-4635, based on global website indexing conducted by WebTechSurvey.
The Mattermost is affected by the CVE-2026-4635 vulnerability.
Mattermost versions up to and including 11.6 are vulnerable to CVE-2026-4635.