Dashboard / CVE-2026-19600

CVE-2026-19600

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 55/100
Published: 2026-10-16 Modified: 2026-10-27 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Unchanged
C: High
I: None
A: None

Description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
mattermost mattermost_server 11.7.0 – 11.7.10

References & Advisories (1)

Bug Bounty Relevance

55 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

4.9 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.24%
Raw Score 0.002360
Percentile 14.7%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00236
2026-10-28
0.00236

Intelligence Sources

nvd ref →

External Links