Live › vulnerability › CVE-2026-19603
Go to dashboardMattermost versions 11.7.x through 11.10.1 do not sanitize the active channel field returned by the user status API endpoints. An authenticated user can learn the channel ID of a private channel another user is currently viewing, without being a member of that channel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Mattermost servers on the affected 11.x release lines are exposed, since any logged-in user can query the status endpoints. Teams on Mattermost Cloud are handled by the vendor, and teams on versions outside the listed ranges are not affected per the sources.
No product ranges from the sources yet.
mmctl version or check the server version in the System Console and compare it against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765
This page as .md · .json · in your agent: get_signal("CVE-2026-19603")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.