Mattermost CVE-2026-19621

Exploitation requires (1) an authenticated account that is a member of a channel, and (2) the presence of interactive-message posts created via action integrations (interactive messages/buttons backed by server-side webhook URLs and secrets) in that channel. The attacker obtains the secrets by observing the post_deleted websocket event broadcast on post deletion, or by reading the threads REST API response, both of which fail to strip the action integration secret. Limiting factors: the attacker must be authenticated (PR:L - not remote-unauthenticated) and must have legitimate access to a channel that actually uses interactive integrations; deployments with no action integrations are not exposed, and the flaw yields confidentiality loss only (no direct integrity/availability impact).

This is a credible but moderate-severity information-disclosure issue rather than an urgent emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) indicates a network-reachable, low-complexity attack requiring only low-privilege authentication (PR:L) and no user interaction, with high confidentiality impact and no integrity or availability impact - consistent with CWE-200 and the description's leak of webhook URLs and authentication context. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the realistic risk is therefore driven by ease of exploitation by an insider/authenticated member rather than by mass opportunistic attacks. The signals are internally consistent - the CVSS confidentiality-only profile matches an information-disclosure CWE and a vendor-reported secret-leakage flaw - so there is no conflict to flag. The main caveat is the absence of exploitation-probability data (no EPSS) and vendor-only sourcing, meaning widespread exploitation cannot be confirmed or ruled out.

An authenticated member of a Mattermost channel that contains interactive-message (action integration) posts deletes such a post or opens the thread via the API, and observes the post_deleted websocket event or threads REST response, which still contains the action integration secret. Using the leaked server-side webhook URL and authentication context, the attacker can then impersonate or invoke the integration. No public exploit code is identified at time of analysis, but exploitation is low-complexity for any channel member.