CVE-2026-19867 — Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

Affected Mattermost versions do not cap the number or size of mention keys stored in a user's notification properties. An authenticated user can use this to increase post-processing latency and consume excessive CPU on behalf of other members who share a channel with the user.