CVE-2026-19541

The record

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761

Affected packages

Related vulnerabilities

• CVE-2026-116861 Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. CWE-201
• CVE-2026-115947 Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. CWE-201
• CVE-2026-119564 Plausible Analytics Community Edition through 3.2.1 contains an information exposure… CWE-201
• CVE-2026-107268 Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor… CWE-201
• CVE-2026-45049 Open Access Management (OpenAM) is an access management solution. CWE-201
• CVE-2026-48200 Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document… CWE-201
• CVE-2026-118083 Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. CWE-201
• CVE-2026-114173 The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data… CWE-201