What is the CVSS score of CVE-2026-7184?

CVE-2026-7184 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Mattermost CVE-2026-7184

EUVD-2026-36500 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-12 Mattermost

GHSA-9p44-r552-4wp9

Mattermost Information Disclosure

6.5

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible API (AV:N) requires manage_secure_connections permission (PR:L); C:H for auth token disclosure; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 17:34 vuln.today

DescriptionCVE.org

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the {{manage_secure_connections}} permission to obtain remote cluster authentication tokens via a PATCH request to the remote cluster endpoint.. Mattermost Advisory ID: MMSA-2026-00662

AnalysisAI

Remote cluster authentication token disclosure in Mattermost's Secure Connections feature allows authenticated users holding the manage_secure_connections permission to retrieve plaintext inter-cluster credentials via a crafted PATCH request. Affected deployments span versions 10.11.x through 10.11.15, 11.5.x through 11.5.4, and 11.6.x through 11.6.1, with a CVSS-rated High confidentiality impact (6.5). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but successful exploitation could undermine the trust model of federated multi-cluster deployments.

Technical ContextAI

Mattermost's Secure Connections feature enables federated communication between distinct Mattermost server deployments via a Remote Cluster API. The PATCH endpoint at the remote cluster resource is intended for updating cluster configuration, but the server returns API responses without sanitizing or redacting the authentication tokens used to authorize inter-cluster communication - a textbook CWE-201 (Insertion of Sensitive Information Into Sent Data) flaw, where secrets that should remain server-side are inadvertently reflected in outbound responses. The affected CPE is cpe:2.3:a:mattermost:mattermost across all editions (Team, E0, Enterprise) within the vulnerable version ranges. The root cause is the absence of a response-scrubbing layer for sensitive fields on PATCH operations, which may have been present on read (GET) operations but not applied consistently to mutation-response payloads.

RemediationAI

The primary fix is to upgrade Mattermost to a release beyond the affected version boundaries: past 11.6.1 in the 11.6.x branch, past 11.5.4 in the 11.5.x branch, or past 10.11.15 in the 10.11.x branch. Exact patched version numbers are not independently confirmed beyond the advisory - consult https://mattermost.com/security-updates (MMSA-2026-00662) for the specific fixed releases before upgrading. As an immediate compensating control, audit and restrict the manage_secure_connections permission to only the minimum set of administrators who operationally require it; removing it from non-essential accounts eliminates the attack surface entirely. Any remote cluster authentication tokens in use on affected deployments should be rotated after patching, as tokens obtained prior to remediation remain valid until explicitly invalidated.