Live › vulnerability › CVE-2026-19621
Go to dashboardMattermost fails to strip action integration secrets from post payloads sent over the post_deleted websocket event and the threads REST API. An authenticated channel member can read server-side webhook URLs and authentication context from interactive-message posts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or cloud Mattermost servers on the listed affected versions that use interactive-message integrations (action buttons and menus) are exposed. Any authenticated member of a channel containing such posts can read the secrets. Servers on other versions or without interactive-message integrations can skip it.
No product ranges from the sources yet.
mattermost version or the System Console version display11.10.0, 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, 11.7.x up to 11.7.9Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted websocket event or the threads REST API.. Mattermost Advisory ID: MMSA-2026-00766
This page as .md · .json · in your agent: get_signal("CVE-2026-19621")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.