CVE-2026-2476
Awaiting Analysis Awaiting Analysis - Queue
Improper Masking in Mattermost Plugins ≤2.0.3 Exposes Sensitive Data

Publication date: 2026-03-16

Last updated on: 2026-03-20

Assigner: Mattermost, Inc.

Description
Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-16
Last Modified
2026-03-20
Generated
2026-06-16
AI Q&A
2026-03-16
EPSS Evaluated
2026-06-15
NVD
CVE-2026-2476
EUVD
EUVD-2026-12387
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mattermost ms_teams to 2.3.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

I don't know

Mitigation Strategies

I don't know

Executive Summary

Mattermost Plugins versions up to 2.0.3.0 do not properly mask sensitive configuration values. This means that an attacker who has access to support packets can retrieve the original plugin settings by exporting configuration data.

Impact Analysis

This vulnerability can lead to exposure of sensitive configuration information to unauthorized users who have access to support packets. Such exposure can compromise the confidentiality of critical plugin settings, potentially allowing attackers to gain insights into system configurations or exploit other weaknesses.

Compliance Impact

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2476. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart