{"id":"CVE-2026-19541","kind":"vulnerability","aliases":["CVE-2026-19541"],"related":[],"title":"Mattermost: outgoing OAuth validation leaks stored client secret to attackers","description":"Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761","summary":"Mattermost fails to require re-entry of the stored client secret when validating an outgoing OAuth connection. An authenticated user who can manage outgoing OAuth connections can point the token URL at an endpoint they control, trigger validation, and receive the stored secret.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mattermost","oauth","package","self-hosted"],"not_affected_if":["auth-required","default-config","managed-hosting"],"how_to_check":"- Check the Mattermost server version in the System Console or with `mattermost version`, and compare it against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.1.\n- Review who holds the permission to manage outgoing OAuth connections in the System Console.","fix":"- Upgrade Mattermost to a fixed release for your branch (the sources list the affected ranges; check the MMSA-2026-00761 advisory for the exact fixed versions, which the sources do not state).\n- Rotate the client secrets stored in outgoing OAuth connections if untrusted users had permission to manage them.","status":"open","published_at":"2026-10-16T07:17:12+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:57:59+00:00","updated_at":"2026-10-25T03:57:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:57:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mattermost to a fixed release for your branch (the sources list the affected ranges; check the MMSA-2026-00761 advisory for the exact fixed versions, which the sources do not state).\n- Rotate the client secrets stored in outgoing OAuth connections if untrusted users had permission to manage them.","reach":"internet","title":"Mattermost: outgoing OAuth validation leaks stored client secret to attackers","impact":"medium","summary":"Mattermost fails to require re-entry of the stored client secret when validating an outgoing OAuth connection. An authenticated user who can manage outgoing OAuth connections can point the token URL at an endpoint they control, trigger validation, and receive the stored secret.","category":"package","nicknames":[],"who_cares":["mattermost","self-hosted","oauth"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated user obtains the stored OAuth client secret for outgoing connections.","analyst_note":"Find the fixed versions for each branch in advisory MMSA-2026-00761 at the Mattermost security updates page; the sources do not list them.","how_to_check":"- Check the Mattermost server version in the System Console or with `mattermost version`, and compare it against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.1.\n- Review who holds the permission to manage outgoing OAuth connections in the System Console.","needs_analyst":true,"not_affected_if":["managed-hosting","auth-required","default-config"],"who_is_affected":"Self-hosted Mattermost servers in the listed affected version ranges are exposed. The attacker needs an account with permission to manage outgoing OAuth connections, so servers where only trusted admins hold that permission carry less risk. Managed or cloud Mattermost instances are handled by the vendor, and servers already on a fixed release can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":3432,"output_tokens":722,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-00761':134C '-19541':13A,16A '-2026':12A,15A,133C '..':128C '11.10':78C '11.10.1':80C '11.7':75C '11.7.10':77C '11.8':72C '11.8.5':74C '11.9':69C '11.9.1':71C 'advisori':130C 'allow':99C 'attack':10A,122C 'attacker-control':121C 'authent':42B,101C 'client':7A,33B,90C 'connect':40B,49B,97C,109C 'control':59B,123C 'cve':11A,14A 'endpoint':57B,124C 'entri':29B,86C 'fail':24B,81C 'host':22B 'id':131C 'leak':5A 'manag':46B,106C 'mattermost':1A,17B,23B,67C,129C 'mmsa':132C 'oauth':3A,18B,39B,48B,96C,108C 'obtain':111C 'outgo':2A,38B,47B,95C,107C 'packag':19B 'permiss':104C 'point':51B,115C 're':28B,85C 're-entri':27B,84C 'receiv':63B 'requir':26B,83C 'secret':8A,34B,66B,91C,113C 'self':21B 'self-host':20B 'store':6A,32B,65B,89C 'token':53B,117C 'trigger':60B,126C 'url':54B,118C 'user':43B,102C 'valid':4A,36B,61B,93C,127C 'version':68C 'via':114C 'x':70C,73C,76C,79C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Mattermost servers in the listed affected version ranges are exposed. The attacker needs an account with permission to manage outgoing OAuth connections, so servers where only trusted admins hold that permission carry less risk. Managed or cloud Mattermost instances are handled by the vendor, and servers already on a fixed release can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"responsibledisclosure@mattermost.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19541","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19541","severity":null,"published_at":"2026-10-16T07:17:12+00:00","modified_at":"2026-10-16T19:23:18+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}