EUVD-2026-12387
GHSA-4ppj-6chv-5pgc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain access to support packet export
-
ExploitExtract plugin configuration data
-
ExecutionIdentify unmasked sensitive values
-
ImpactRetrieve original plugin settings
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Mattermost Plugins version ≤2.0.3.0 with support packet generation enabled. Attacker requires high-level administrative access (PR:H) to generate or access exported support packets containing plugin configuration. |
| Impact | While the CVSS score of 7.6 indicates high severity, the real-world risk is significantly mitigated by the requirement for high privileges (PR:H) and the specific attack scenario requiring access to support packets. The attack vector is network-based (AV:N) with low complexity (AC:L), but the prerequisite of already having high privileges substantially reduces the likelihood of exploitation. No EPSS score, KEV listing, or known proof-of-concept exists, suggesting minimal real-world exploitation activity. The changed scope (S:C) indicates potential impact beyond the vulnerable component, but the practical exploitation barrier of requiring legitimate high-privilege access makes this a lower priority than the CVSS score suggests. |
| Exploit ScenarioDerived | An attacker with legitimate high-privilege access to a Mattermost instance could generate or request access to support packets, then extract unmasked sensitive configuration values from the exported data, potentially obtaining API keys, database credentials, or authentication tokens used by various plugins. The attack requires no user interaction and can be executed remotely once the attacker has obtained the necessary privileges, making insider threats or compromised administrator accounts the primary risk vectors. No public proof-of-concept exists, but exploitation would be straightforward for anyone with the requisite access level. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
A sensitive information disclosure vulnerability in Mattermost Plugins versions 2.0.3.0 and earlier fails to properly mask sensitive configuration values in support packets, allowing attackers with high privileges to extract original plugin settings from exported configuration data. The vulnerability requires authenticated access with high privileges (CVSS 7.6) and enables attackers to obtain sensitive configuration data that should be masked, potentially exposing API keys, credentials, or other sensitive plugin configurations. No active exploitation or proof-of-concept has been reported, and the vulnerability requires significant access privileges to exploit.
RemediationAI
Upgrade Mattermost Plugins to a version newer than 2.0.3.0 as recommended in Mattermost security advisory MMSA-2026-00606 available at https://mattermost.com/security-updates. As an immediate mitigation, restrict access to support packet generation functionality to only essential personnel and implement additional access controls around diagnostic export features. Organizations should audit existing support packets for potential exposure of sensitive configuration data and rotate any credentials that may have been inadvertently exposed through previously generated support packets.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects Mattermost Plugins as identified by CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*, specifically versions up to and including 2.0.3.0. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), which occurs when the software exposes sensitive information through observable discrepancies in behavior, response times, or resource consumption. In this case, the plugin framework fails to properly sanitize or mask sensitive configuration values when generating support packets, which are diagnostic exports typically used for troubleshooting that should redact sensitive data before sharing.
Know when Mattermost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606
Executive ViewAI
A vulnerability in Mattermost Plugins versions 2.0.3.0 and earlier could allow privileged users to extract sensitive configuration data (API keys, credentials) from support packets that should be masked. While exploitation requires high-level administrative access and no active attacks have been reported, organizations using affected versions face potential credential compromise if an insider threat or compromised admin account is present.
Disable or restrict support packet export functionality to only critical operations personnel. Implement privileged access management (PAM) controls to limit which administrators can generate and access support packets. Enable comprehensive audit logging for all configuration data exports. Conduct access reviews of users with high-privilege roles in Mattermost. Implement network segmentation to restrict access to Mattermost administrative interfaces.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Mattermost Authorization and Validation Flaws
View all 3More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB