CVE-2026-19600EPSS p13.6%

CVE-2026-19600CVE-2026-19600

Description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763

Scoring

CVSS 4.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
EPSS0.24% probability of exploitation · percentile 13.6% · 2026-10-17T12:00:28Z
Last modified2026-10-16
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.