CVE-2026-19603: Mattermost Information Disclosure Vulnerability

CVE-2026-19603 Overview

CVE-2026-19603 is an information disclosure vulnerability in multiple Mattermost versions. The flaw resides in the user status API endpoints, which fail to sanitize the active channel field. An authenticated user can learn the channel ID of a private channel another user is actively viewing without being a member of that channel. The issue is tracked by Mattermost Advisory ID MMSA-2026-00765 and classified under [CWE-201] Insertion of Sensitive Information Into Sent Data.

Critical Impact
Authenticated users can enumerate private channel identifiers that other users are viewing, breaking the confidentiality boundary of membership-restricted channels.

Affected Products

Mattermost 11.9.x versions up to and including 11.9.1
Mattermost 11.8.x versions up to and including 11.8.5
Mattermost 11.7.x versions up to and including 11.7.10
Mattermost 11.10.x versions up to and including 11.10.1

Discovery Timeline

2026-10-16 - CVE-2026-19603 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-19603

Vulnerability Analysis

The vulnerability affects the Mattermost user status API endpoints. These endpoints return presence information about users, including the identifier of the channel each user is actively viewing. Mattermost does not strip the active channel field based on the requesting user's channel membership.

As a result, an authenticated user who queries status for another user receives the private channel ID that target is viewing. The attacker does not need to be a member of the private channel. While only the channel identifier leaks, that identifier can be used in follow-on reconnaissance to correlate user activity and target specific private discussions.

Root Cause

The root cause is missing authorization filtering on API response data. The status endpoints emit the active_channel field without validating whether the requesting principal has membership in the referenced channel. This maps to [CWE-201] Insertion of Sensitive Information Into Sent Data.

Attack Vector

Exploitation requires network access to the Mattermost API and a valid authenticated session with low privileges. The attacker calls the user status API endpoints for one or more target user IDs. The response includes the private channel ID the target is currently viewing. No user interaction is required from the victim beyond their normal use of the application. See the Mattermost Security Updates advisory for technical details.

Detection Methods for CVE-2026-19603

Indicators of Compromise

Unusual volume of requests to the user status API endpoints from a single authenticated session or API token.
Enumeration patterns where one account polls status for a wide range of user IDs in sequence.
API clients requesting status data that do not correspond to typical UI-driven workflows.

Detection Strategies

Review Mattermost server access logs for repeated calls to /api/v4/users/status/ids and related status routes.
Correlate authenticated user IDs with the breadth of distinct target user IDs they query over short time windows.
Baseline normal client behavior and alert on sessions that deviate by issuing bulk status lookups.

Monitoring Recommendations

Forward Mattermost application and reverse proxy logs to a centralized analytics platform for query and alerting.
Build detections for low-and-slow enumeration against status endpoints, not only burst traffic.
Monitor for personal access tokens or bot accounts issuing status API calls outside their documented purpose.

How to Mitigate CVE-2026-19603

Immediate Actions Required

Upgrade Mattermost to a fixed release above 11.9.1, 11.8.5, 11.7.10, or 11.10.1 as published in the vendor advisory.
Audit personal access tokens and integrations and revoke tokens that are not required.
Review recent access to status endpoints for signs of enumeration prior to patching.

Patch Information

Mattermost has issued fixes under advisory MMSA-2026-00765. Administrators should consult the Mattermost Security Updates page for exact fixed version numbers and upgrade guidance for each supported release branch.

Workarounds

Restrict Mattermost API access to trusted networks where upgrading immediately is not feasible.
Limit creation of new user accounts and bot integrations until patching is complete.
Enforce stricter rate limiting on /api/v4/users/status endpoints at the reverse proxy to slow enumeration.

bash

# Example NGINX rate limit for Mattermost status endpoints
limit_req_zone $binary_remote_addr zone=mm_status:10m rate=10r/s;

location /api/v4/users/status {
    limit_req zone=mm_status burst=20 nodelay;
    proxy_pass http://mattermost_backend;
}