Description
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763
Affected products
mattermost: mattermost server
References1
- mattermost.com/security-updates Vendor Advisory
Metrics
- CVSS 3.1
-
4.9
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 0% percentile: 15 · as of 10 November 2026
- CWE
- CWE-532
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.