Mattermost CVE-2026-19603

Requires a valid authenticated account on the target Mattermost server (PR:L) with network access to the user status API endpoints; no membership in the target private channel is needed, which is precisely the flaw. Limiting factors: the attacker must already be a provisioned user on the same instance, exploitation only reveals the channel ID of a private channel another user is actively viewing (not its contents, name, or member list), and the leak depends on the victim actively viewing the channel at query time. Affected only on Mattermost 11.9.x ≤ 11.9.1, 11.8.x ≤ 11.8.5, 11.7.x ≤ 11.7.10, and 11.10.x ≤ 11.10.1; instances on fixed builds or other release lines are not affected.

This is a low-to-moderate severity information disclosure flaw (CVSS 4.3) that is a genuine but low-urgency issue rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network-reachable, low-complexity exploitation but requires low-privilege authentication (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability impact. Per CWE-201, the leak is narrow: an authenticated user can learn the channel ID of a private channel another user is actively viewing via the status API, without membership. EPSS score was not provided in the input and cannot be assessed. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation. All signals are internally consistent - low real-world risk: exploitation requires an existing authenticated account on the Mattermost instance and leaks only a channel identifier (not channel contents, names, or membership), making this primarily a privacy/metadata-leak concern useful for internal reconnaissance rather than a direct compromise vector.

An authenticated low-privilege Mattermost user repeatedly polls the user status API endpoints to read the unsanitized active channel field for a targeted user. By observing the returned private channel IDs over time, the attacker maps which private channels a victim is actively viewing despite having no membership in them. No public proof-of-concept exists, and exploitation is low-complexity (AC:L) once the attacker holds any valid account.