UpHeron
All vulnerabilities

Servers and applications

CVE-2026-19541

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation..…

Severity
Medium 6.5
Published
16 Oct 2026
Last changed
29 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
11.7.11, 11.8.6, 11.9.2, 11.10.2
Sources
NVD

Affected software

SoftwareAffected versions
MattermostServers and applications · cpe:a:mattermost:mattermost_server
  • From 11.7.0 before 11.7.11
  • From 11.8.0 before 11.8.6
  • From 11.9.0 before 11.9.2
  • From 11.10.0 before 11.10.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-19541
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-19541