{"id":"CVE-2026-19621","kind":"vulnerability","aliases":["CVE-2026-19621"],"related":[],"title":"Mattermost: channel members can read integration webhook secrets from posts","description":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted websocket event or the threads REST API.. Mattermost Advisory ID: MMSA-2026-00766","summary":"Mattermost fails to strip action integration secrets from post payloads sent over the post_deleted websocket event and the threads REST API. An authenticated channel member can read server-side webhook URLs and authentication context from interactive-message posts.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chat","mattermost","runtime","self-hosted","webhooks"],"not_affected_if":["no-interactive-message-integrations","unpatched-versions-only"],"how_to_check":"- Check the running Mattermost version with `mattermost version` or the System Console version display\n- Compare against affected ranges: 11.10.x up to `11.10.0`, 11.9.x up to `11.9.1`, 11.8.x up to `11.8.5`, 11.7.x up to `11.7.9`","fix":"- Upgrade Mattermost to a release that includes the fix from advisory MMSA-2026-00766 (fixed version unknown from the sources)\n- Rotate any webhook URLs or integration tokens used by interactive-message actions if exposure is suspected","status":"open","published_at":"2026-10-16T08:17:13+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:57:58+00:00","updated_at":"2026-10-25T03:57:58+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:57:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mattermost to a release that includes the fix from advisory MMSA-2026-00766 (fixed version unknown from the sources)\n- Rotate any webhook URLs or integration tokens used by interactive-message actions if exposure is suspected","reach":"network","title":"Mattermost: channel members can read integration webhook secrets from posts","impact":"medium","summary":"Mattermost fails to strip action integration secrets from post payloads sent over the post_deleted websocket event and the threads REST API. An authenticated channel member can read server-side webhook URLs and authentication context from interactive-message posts.","category":"runtime","nicknames":[],"who_cares":["mattermost","self-hosted","chat","webhooks"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attackers read webhook URLs and auth context, enabling impersonation of integrations.","analyst_note":"Fixed version and whether interactive-message integrations are common by default are not in the sources; check MMSA-2026-00766 on the Mattermost security updates page.","how_to_check":"- Check the running Mattermost version with `mattermost version` or the System Console version display\n- Compare against affected ranges: 11.10.x up to `11.10.0`, 11.9.x up to `11.9.1`, 11.8.x up to `11.8.5`, 11.7.x up to `11.7.9`","needs_analyst":true,"not_affected_if":["unpatched-versions-only","no-interactive-message-integrations"],"who_is_affected":"Self-hosted or cloud Mattermost servers on the listed affected versions that use interactive-message integrations (action buttons and menus) are exposed. Any authenticated member of a channel containing such posts can read the secrets. Servers on other versions or without interactive-message integrations can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":3440,"output_tokens":657,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-00766':139C '-19621':13A,16A '-2026':12A,15A,138C '..':133C '11.10':67C '11.10.0':69C '11.7':70C '11.7.9':72C '11.8':76C '11.8.5':78C '11.9':73C '11.9.1':75C 'action':28B,82C 'advisori':135C 'allow':102C 'api':45B,99C,132C 'authent':47B,58B,104C,115C 'broadcast':89C 'channel':2A,48B,105C 'chat':17B 'context':59B,116C 'cve':11A,14A 'delet':38B,92C,125C 'event':40B,95C,127C 'fail':25B,79C 'host':22B 'id':136C 'integr':6A,29B,83C 'interact':62B,119C 'interactive-messag':61B,118C 'mattermost':1A,18B,24B,65C,134C 'member':3A,49B,106C 'messag':63B,120C 'mmsa':137C 'obtain':108C 'payload':33B,87C 'post':10A,32B,37B,64B,86C,91C,121C,124C 'post-delet':90C 'read':5A,51B 'respons':100C 'rest':44B,131C 'return':97C 'runtim':19B 'secret':8A,30B,84C 'self':21B 'self-host':20B 'sent':34B 'server':53B,110C 'server-sid':52B,109C 'side':54B,111C 'socket':94C 'strip':27B,81C 'thread':43B,98C,130C 'url':56B,113C 'version':66C 'via':122C 'web':93C 'webhook':7A,23B,55B,112C 'websocket':39B,126C 'x':68C,71C,74C,77C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or cloud Mattermost servers on the listed affected versions that use interactive-message integrations (action buttons and menus) are exposed. Any authenticated member of a channel containing such posts can read the secrets. Servers on other versions or without interactive-message integrations can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T08:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"responsibledisclosure@mattermost.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19621","severity":null,"published_at":"2026-10-16T08:17:13+00:00","modified_at":"2026-10-16T19:23:18+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}