CVE-2026-6345
Password Disclosure in Mattermost
Publication date: 2026-05-18
Last updated on: 2026-05-18
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mattermost_server | From 10.11.0 (inc) to 10.11.14 (exc) |
| mattermost | mattermost_server | From 11.4.0 (inc) to 11.4.4 (exc) |
| mattermost | mattermost_server | From 11.5.0 (inc) to 11.5.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Mattermost versions 11.5.x up to 11.5.1, 10.11.x up to 10.11.13, and 11.4.x up to 11.4.3. It involves a failure to prevent the disclosure of created user passwords. Because of this flaw, a malicious attacker can obtain some of these passwords and use them to impersonate legitimate users.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access by attackers who obtain user passwords. This allows them to impersonate users, potentially gaining access to sensitive information or performing actions on behalf of those users. The CVSS score of 6.5 indicates a medium to high severity, with high impact on confidentiality and integrity.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Mattermost to a version later than 11.5.1, 10.11.13, or 11.4.3, as these versions contain the fix that prevents disclosure of created user passwords.
Additionally, monitor the Mattermost Security Updates page for any further patches or advisories.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, and 11.4.x <= 11.4.3 allows disclosure of created user passwords, enabling malicious attackers to impersonate users.
Such unauthorized disclosure of user credentials can lead to violations of data protection and privacy regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.
Therefore, this vulnerability potentially impacts compliance by exposing sensitive user authentication data, increasing the risk of data breaches and unauthorized access.