{"id":"CVE-2026-19600","kind":"vulnerability","aliases":["CVE-2026-19600"],"related":[],"title":"Mattermost: session and OAuth tokens written to debug logs","description":"Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763","summary":"Several Mattermost server versions write authentication tokens into debug-level server log entries without sanitizing them. Anyone who can read those logs can take valid session or OAuth tokens and impersonate logged-in users.","severity":"medium","cvss":4.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["logging","mattermost","package","self-hosted"],"not_affected_if":["default-config","patched-version"],"how_to_check":"- Run `mmctl version` or check the server version under System Console to compare against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.1.\n- Check whether the log level is set to DEBUG in the server config (`LogSettings.ConsoleLevel` or `FileLevel`) and whether logs are shipped to a shared location.","fix":"- Upgrade Mattermost to a fixed release: a version newer than 11.7.10, 11.8.5, 11.9.1 or 11.10.1 on the matching branch (exact fixed version: unknown in sources).\n- Until upgraded, set log level above DEBUG, and rotate session tokens and OAuth access tokens for users if debug logs were exposed.","status":"open","published_at":"2026-10-16T08:17:13+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:35:42+00:00","updated_at":"2026-10-25T04:35:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:35:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mattermost to a fixed release: a version newer than 11.7.10, 11.8.5, 11.9.1 or 11.10.1 on the matching branch (exact fixed version: unknown in sources).\n- Until upgraded, set log level above DEBUG, and rotate session tokens and OAuth access tokens for users if debug logs were exposed.","reach":"local","title":"Mattermost: session and OAuth tokens written to debug logs","impact":"high","summary":"Several Mattermost server versions write authentication tokens into debug-level server log entries without sanitizing them. Anyone who can read those logs can take valid session or OAuth tokens and impersonate logged-in users.","category":"package","nicknames":[],"who_cares":["mattermost","self-hosted","logging"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with log access impersonates users using stolen session tokens","analyst_note":"Confirm the fixed version for each branch and whether debug level is required; see the MMSA-2026-00763 advisory on mattermost.com.","how_to_check":"- Run `mmctl version` or check the server version under System Console to compare against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.1.\n- Check whether the log level is set to DEBUG in the server config (`LogSettings.ConsoleLevel` or `FileLevel`) and whether logs are shipped to a shared location.","needs_analyst":true,"not_affected_if":["default-config","patched-version"],"who_is_affected":"Self-hosted Mattermost servers running one of the listed affected versions, especially with debug logging enabled or logs readable by other staff, log aggregators, or tools. Servers on a version outside the listed ranges, or running without debug logging and with tightly restricted log access, face lower exposure. The sources do not name a managed-hosting status.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":3424,"output_tokens":718,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-00763':120C '-19600':12A,15A '-2026':11A,14A,119C '..':114C '11.10':69C '11.10.1':71C '11.7':66C '11.7.10':68C '11.8':63C '11.8.5':65C '11.9':60C '11.9.1':62C 'access':89C,100C 'advisori':116C 'allow':85C 'anyon':39B 'attack':87C 'authent':27B,75C,104C 'cve':10A,13A 'debug':8A,31B,109C 'debug-level':30B,108C 'entri':35B,83C 'fail':72C 'host':21B 'id':117C 'imperson':53B,103C 'level':32B,110C 'log':9A,16B,34B,44B,55B,82C,92C,113C 'logged-in':54B 'mattermost':1A,17B,23B,58C,111C,115C 'mmsa':118C 'oauth':4A,50B,99C 'obtain':94C 'packag':18B 'read':42B 'sanit':37B,74C 'self':20B 'self-host':19B 'server':24B,33B,81C,91C,112C 'session':2A,48B,96C 'sever':22B 'take':46B 'token':5A,28B,51B,76C,97C,101C 'user':57B,105C 'valid':47B,95C 'version':25B,59C 'via':106C 'without':36B 'write':26B,78C 'written':6A 'x':61C,64C,67C,70C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Mattermost servers running one of the listed affected versions, especially with debug logging enabled or logs readable by other staff, log aggregators, or tools. Servers on a version outside the listed ranges, or running without debug logging and with tightly restricted log access, face lower exposure. The sources do not name a managed-hosting status.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T08:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","cvss_by":"responsibledisclosure@mattermost.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19600","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19600","severity":null,"published_at":"2026-10-16T08:17:13+00:00","modified_at":"2026-10-16T19:23:18+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}