Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0 Web Socket information disclosure

Summaryinfo

A vulnerability classified as problematic was found in Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0. This vulnerability affects unknown code of the component Web Socket. Executing a manipulation can lead to information disclosure. The identification of this vulnerability is CVE-2026-19621. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0 and classified as problematic. This vulnerability affects an unknown function of the component Web Socket. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted websocket event or the threads REST API.. Mattermost Advisory ID: MMSA-2026-00766

The advisory is shared for download at mattermost.com. This vulnerability was named CVE-2026-19621 since 08/12/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 11.7.10, 11.8.6, 11.9.2, 11.10.1 or 11.11.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-102743). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Groupware Software

Name

• Mattermost

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.7.0
• 11.7.1
• 11.7.2
• 11.7.3
• 11.7.4
• 11.7.5
• 11.7.6
• 11.7.7
• 11.7.8
• 11.7.9
• 11.8
• 11.8.0
• 11.8.1
• 11.8.2
• 11.8.3
• 11.8.4
• 11.8.5
• 11.9
• 11.9.0
• 11.9.1
• 11.10.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion