EUVD-2026-60543
GHSA-jq35-5w25-hqv7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local-only attack via readable file; no OS privileges needed; user must generate report (UI:R); scope changes to server via leaked pre-auth credential; confidentiality only.
Primary rating from Vendor (Mattermost).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716
AnalysisAI
Mattermost Desktop App versions through 6.2.2.0 expose the pre-auth server secret in plaintext within generated diagnostics reports, specifically in the Server Connectivity Step-3 output section. A local attacker who obtains a copy of a user's diagnostics report or log files - whether through filesystem access or social engineering - can extract this secret and use it to authenticate against the configured Mattermost server as a pre-authorized client. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: first, the pre-auth secret feature must be configured on the connected Mattermost server - this is a non-default deployment option not universally enabled; second, the victim user must have generated a diagnostics report at some point using the affected Desktop App, producing a file that captures the plaintext secret in the Server Connectivity Step-3 section; third, the attacker must have local read access to this diagnostics report or associated log files, either via shared filesystem access, receiving the file from the user, or post-compromise file access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 3.6 (Low) accurately reflects real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with read access to a shared workstation or who receives a forwarded diagnostics report from a Mattermost Desktop App user opens the Server Connectivity Step-3 section of the report and locates the pre-auth secret in plaintext. The attacker then uses this secret to configure their own client to authenticate against the victim's Mattermost server instance, bypassing the pre-auth access control layer. … |
| Remediation | Upgrade the Mattermost Desktop App to a version beyond 6.2.2.0 as directed by the Mattermost security advisory at https://mattermost.com/security-updates (MMSA-2026-00716); the exact patched release version is not confirmed in the available input data and should be verified directly with the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mattermost
View allDenial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invit
Dex is a federated OpenID Connect provider written in Go. Rated critical severity (CVSS 9.6), this vulnerability is remo
Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers t
Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, wh
Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker posse
Privilege escalation in Mattermost server (11.6.x, 11.5.x, and 10.11.x branches) allows a low-privileged user holding gr
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today