CVE-2026-19621
Received Received - Intake

Exposure of Webhook Secrets in Mattermost Post Deletion

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted websocket event or the threads REST API.. Mattermost Advisory ID: MMSA-2026-00766

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-19621
EUVD
EUVD-2026-102743

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Mattermost Mattermost 11.10.0
Mattermost Mattermost 11.7.0
Mattermost Mattermost 11.9.0
Mattermost Mattermost 11.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mattermost versions between 11.7.0 and 11.10.0 fail to remove action integration secrets from post payloads when deleting posts. This causes secrets like webhook URLs and authentication details to be exposed via post_deletion web socket events or thread API responses. An authenticated channel member can exploit this to obtain sensitive server-side integration secrets.

Impact Analysis

If you use Mattermost versions 11.7.0 to 11.10.0, an attacker with access to your channel could steal webhook URLs and authentication tokens. This could allow them to send unauthorized messages, impersonate your integrations, or access sensitive data shared through those integrations.

Mitigation Strategies

Upgrade Mattermost to a version that is not affected by this vulnerability. Specifically, versions 11.10.x > 11.10.0, 11.7.x > 11.7.9, 11.9.x > 11.9.1, and 11.8.x > 11.8.5 address this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart