CVE-2026-19603

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the...

EUVD-2026-102742

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the...

Cosmos: Replacing ICA active channel during the upgrade and a bit more

The active channel on the ICA controller was set during the channel acknowledgement, which was a check-then-act operation that was not atomic. The active channel on the ICA host was set during the channel open confirmation, but the check for the channel existence was not atomic. This allowed an...