Mattermost CVE-2026-19541

Requires an authenticated Mattermost account possessing the specific permission to manage outgoing OAuth connections, plus at least one existing outgoing OAuth connection with a stored client secret. The attacker must be able to modify that connection's token URL to an attacker-controlled endpoint and invoke the connection-validation flow. Limiting factors: exploitation is gated behind this administrative permission (not available to ordinary users), the feature (outgoing OAuth connections) must be in use, and the instance must run an affected version (11.7.x <= 11.7.10, 11.8.x <= 11.8.5, 11.9.x <= 11.9.1, 11.10.x <= 11.10.1). No end-user interaction by a victim is needed.

This is a medium-severity information-disclosure flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-201) whose real-world risk is tempered by its privilege prerequisite. The network vector and low attack complexity are offset by the requirement that the attacker already be an authenticated user holding the permission to manage outgoing OAuth connections - an administrative capability, not a standard user right. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified from the data at hand. The impact is confidentiality-only (C:H, I:N, A:N): disclosure of a stored OAuth client secret. This is a legitimate hardening/priority issue for Mattermost operators but is not a mass-exploitation or wormable threat; it reads as an insider/privilege-abuse or compromised-admin-account scenario rather than a widespread remote-takeover risk. Note the privilege ambiguity: the CVSS vector encodes PR:L, yet the described 'permission to manage outgoing OAuth connections' is typically an elevated/admin permission, which would argue for PR:H - verify the exact role model with Mattermost before relying on the PR:L rating.

An authenticated Mattermost user (or a compromised account) that holds the permission to manage outgoing OAuth connections edits an existing connection and points its token URL at an attacker-controlled endpoint, then triggers the 'validate' action. Because the server does not require re-entry of the stored client secret, it replays the previously stored secret to the attacker's endpoint, disclosing it. No public exploit identified at time of analysis.