CVE-2026-19603: Private channel ID disclosure via user status endpoints
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.6 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.11 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Mattermost user can exploit it. The attacker does not need to be a member of the private channel whose ID is disclosed.
What information is exposed, and what must the victim be doing?
The affected user status API endpoints can disclose the ID of a private channel that another user is actively viewing. The exposure is limited to the channel ID; no additional channel content or permissions are described.
Are affected deployments exposed by default?
The issue is in the active-channel field returned by user status API endpoints. The provided information does not identify a configuration prerequisite or mitigation setting.
Which Mattermost releases are affected?
Affected releases are Mattermost 11.9.x through 11.9.1, 11.8.x through 11.8.5, 11.7.x through 11.7.10, and 11.10.x through 11.10.1.