UpHeron
All vulnerabilities

Servers and applications

CVE-2026-19600

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID:…

Severity
Medium 4.9
Published
16 Oct 2026
Last changed
27 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
11.7.10, 11.8.6, 11.9.2, 11.10.2
Sources
NVD

Affected software

SoftwareAffected versions
MattermostServers and applications · cpe:a:mattermost:mattermost_server
  • From 11.7.0 before 11.7.10
  • From 11.8.0 before 11.8.6
  • From 11.9.0 before 11.9.2
  • From 11.10.0 before 11.10.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-19600
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-19600