Mattermost implementations fail to strip action‑integration secrets from post payloads before broadcasting post‑deletion websocket events and returning thread API responses. The result is that any authenticated member of a channel can obtain server‑side webhook URLs and authentication context from interactive‑message posts. If an attacker can acquire these secrets, they may use the webhook to post arbitrary content or gain further privileged access, leading to sensitive data exposure and potential escalation.

The vulnerability affects Mattermost Mattermost versions 11.10.x (<= 11.10.0), 11.7.x (<= 11.7.9), 11.9.x (<= 11.9.1), and 11.8.x (<= 11.8.5). The CVE advisory states that upgrading to 11.11.0, 11.10.1, 11.7.10, 11.9.2, 11.8.6, or any later release resolves the issue.

The CVSS score is 6.5, indicating a medium severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated channel member; the attacker can trigger a post deletion or read a thread to receive the compromised payload via the post_deleted websocket event or the threads REST API. The attack vector is remote through standard web socket or API traffic, with no need for elevated privileges.