CVE-2026-19603CWE-201

CVE-2026-19603

Medium · published October 16, 2026

CVSS v3.1

4.3

EPSS

Percentile

6.8

In the wild

Unconfirmed

What it is

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00176 · 6.8th percentile
Weakness: CWE-201 · Insertion of Sensitive Information Into Sent Data
Published: 2026-10-16T11:17Z

References (1)

https://mattermost.com/security-updates · [email protected]

EPSS history

Timeline

17 OCT 03:28Z
EPSS moved — → 0%
epss
16 OCT 07:02Z
Private channel ID disclosure via user status endpoints
cvelistv5
16 OCT 07:02Z
Private channel ID disclosure via user status endpoints
cvelistv5