CVE-2026-19600CWE-532

CVE-2026-19600

Medium · published October 16, 2026

CVSS v3.1
4.5
EPSS
0%
Percentile
13.8
In the wild
Unconfirmed
What it is

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763

The record
Technical detail
CVSS v3.1
4.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00236 · 13.8th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-10-16T12:17Z
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 16 OCT 07:07Z
    Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts
    cvelistv5
  • 16 OCT 07:07Z
    Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts
    cvelistv5