CVE-2026-19601 — Disclosure of AD/LDAP bind password via Test Connection

Affected Mattermost versions fail to invalidate the stored AD/LDAP bind password when other connection settings are changed. This may allow a System Console administrator to disclose the plaintext password to an attacker-controlled server through the Test Connection or diagnostics feature.