CVE-2026-2476
Awaiting Analysis Awaiting Analysis - Queue

Improper Masking in Mattermost Plugins ≤2.0.3 Exposes Sensitive Data

Publication date: 2026-03-16

Last updated on: 2026-03-20

Assigner: Mattermost, Inc.

Description
Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-16
Last Modified
2026-03-20
Generated
2026-07-06
AI Q&A
2026-03-16
EPSS Evaluated
2026-07-05
NVD
CVE-2026-2476
EUVD
EUVD-2026-12387

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mattermost ms_teams to 2.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Detection Guidance

I don't know

Executive Summary

Mattermost Plugins versions up to 2.0.3.0 do not properly mask sensitive configuration values. This means that an attacker who has access to support packets can retrieve the original plugin settings by exporting configuration data.

Impact Analysis

This vulnerability can lead to exposure of sensitive configuration information to unauthorized users who have access to support packets. Such exposure can compromise the confidentiality of critical plugin settings, potentially allowing attackers to gain insights into system configurations or exploit other weaknesses.

Compliance Impact

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2476. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart