---
id: "CVE-2026-19603"
kind: "vulnerability"
aliases: ["CVE-2026-19603"]
title: "Mattermost: user status API leaks private channel IDs to authenticated users"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["chat", "mattermost", "package", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-16T07:17:12+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:41:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19603", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Mattermost: user status API leaks private channel IDs to authenticated users

Mattermost versions 11.7.x through 11.10.1 do not sanitize the active channel field returned by the user status API endpoints. An authenticated user can learn the channel ID of a private channel another user is currently viewing, without being a member of that channel.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `mmctl version` or check the server version in the System Console and compare it against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.1.

## Fix

- Upgrade self-hosted Mattermost to a release that includes the fix for MMSA-2026-00765 in each affected line (the fixed version numbers are unknown from the sources; check the Mattermost advisory MMSA-2026-00765).

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19603

## From the sources

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_