Mattermost Desktop CVE-2025-13321

Exploitation requires that the attacker already possess local access to the system running Mattermost Desktop App (version <6.0.0) and be able to read the application's log files under a user account - consistent with PR:L and AV:L. The sensitive data is exposed because the client fails to sanitize it from logs and fails to clear stored data when a server is deleted, so the condition is simply that such logs or residual data exist on disk. Limiting factors: no remote or network exploitation is possible, no privilege escalation is granted, and impact is confined to disclosure of whatever sensitive information happened to be logged - making this a post-compromise concern rather than an initial-access flaw.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 3.3) describes a local, low-privilege information-disclosure flaw with only low confidentiality impact and no integrity or availability impact - exploitation requires the attacker to already have access to the victim's system and be able to read the application's log files. The EPSS score of 0.12% (2nd percentile) reinforces this, indicating effectively negligible likelihood of widespread exploitation. The vulnerability is NOT on the CISA KEV list (no confirmed active exploitation), and no public exploit code is referenced. There is no SSVC decision data in the input. The practical risk is bounded by its secondary nature: sensitive data in logs is only valuable to an actor who has already compromised the local host, making this a post-compromise/defense-in-depth concern rather than an initial-access vector. No signals conflict; all point to low real-world urgency.

An attacker who has already gained local access to a user's workstation (via malware, a stolen/shared device, or another foothold) reads the Mattermost Desktop application log files and recovers sensitive information that was not sanitized - or data that persisted after a server was deleted from the client. No public exploit code is identified, and no user interaction or network access is involved; the attacker simply opens the log files with the privileges of a local account.