User Status API Vulnerability in Mattermost
CVE-2026-19603

4.3MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
16 October 2026

What is CVE-2026-19603?

The Mattermost platform features a vulnerability in versions 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, 11.7.x up to 11.7.10, and 11.10.x up to 11.10.1. Specifically, the active channel field returned by the user status API endpoints is not correctly sanitized. This shortcoming allows authenticated users to potentially discover the channel ID of private channels that other users are actively viewing, even when they do not belong to those channels. This exposure can lead to privacy concerns and could be exploited for information gathering. For further details, refer to the Mattermost Security Advisory.

Affected Version(s)

Mattermost 11.9.0 <= 11.9.1

Mattermost 11.8.0 <= 11.8.5

Mattermost 11.7.0 <= 11.7.10

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CERT PL
.