CVE-2026-19603 — Private channel ID disclosure via user status endpoints

Affected Mattermost versions fail to sanitize the active channel field returned by user status API endpoints. This allows an authenticated user to learn the ID of a private channel another user is actively viewing without being a member of that channel.