MEDIUMCVSS v3.1 4.5Vulnerability
CVE-2026-19600
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-20T21:14:08.448323+00:00
- Epss score
- 0.00236
- Cvss score
- 4.5
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-10-21T01:24:49+00:00
- Last source
- FIRST EPSS
- Score
- 4.5
- Cvss version
- 3.1
- Cve id
- CVE-2026-19600
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
- First seen by Signal
- 2026-10-18T13:39:03+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
- Published at
- 2026-10-16T08:17:13.283
- Last modified
- 2026-10-16T19:23:18.623
- Epss percentile
- 0.13739
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph