CVE-2026-19600Medium· 4.5▾ SunlitMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 24.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763
Mattermost >= 11.9.0 <= 11.9.1Mattermost >= 11.8.0 <= 11.8.5Mattermost >= 11.7.0 <= 11.7.10Mattermost >= 11.10.0 <= 11.10.1Update Mattermost to versions 11.11.0, 11.9.2, 11.8.6, 11.7.11, 11.10.2 or higher.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-19541Medium· 6.5Outgoing OAuth connection client secret exposure during connection validation
CVE-2026-19601Medium· 4.9Disclosure of AD/LDAP bind password via Test Connection
CVE-2026-18551Medium· 6.5Mattermost guest account privilege escalation via member roles API
CVE-2026-19867Medium· 4.3Uncapped mention keys in user notification properties allow CPU exhaustion during post processing
CVE-2026-18795Medium· 6.4Missing server side validation allowed user to quarantine a DM and GM post
CVE-2026-19621Medium· 6.5Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads