CVE-2026-19621: Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain server-side webhook URLs and authentication context from interactive-message posts via the postdeleted websocket event or the threads REST API.. Mattermost Advisory ID: MMSA-2026-00766
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.1 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.10 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who is a member of the affected channel can exploit it. Administrative privileges are not required.
What information can be exposed?
The issue can disclose server-side webhook URLs and authentication context associated with interactive-message posts, including action integration secrets.
Which access paths expose the secrets?
Secrets may be available in post-deletion WebSocket broadcasts through the post_deleted event or in thread data returned by the threads REST API.
What versions are affected?
Affected releases are Mattermost 11.10.0, 11.7.9 and earlier within the 11.7.x line, 11.9.1 and earlier within the 11.9.x line, and 11.8.5 and earlier within the 11.8.x line.