Mattermost EUVD-2026-102807

Requires an authenticated System Console administrator and an existing AD/LDAP integration with a stored bind password. The specific precondition is that an operator changes other LDAP connection settings (e.g., the server address) WITHOUT re-entering the bind password - the stored plaintext credential is not invalidated - and then invokes the Test Connection / diagnostics feature, which transmits that credential to the configured (attacker-controlled) server address. Limiting factors: exploitation is gated behind System Console admin privileges (PR:H), depends on LDAP/AD being configured, and requires the deliberate admin console action of pointing the connection at an attacker-controlled host; it is not reachable by unauthenticated or low-privileged users.

This is a genuine but moderate-priority issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) is internally consistent with the description: exploitation requires high privileges (PR:H - a System Console administrator) and yields high confidentiality impact (C:H - plaintext LDAP bind credential disclosure) with no integrity or availability impact. The key mitigating signal is PR:H: the actor must already hold System Console administrator rights, which sharply narrows the realistic threat to a malicious/compromised admin or an attacker who has already escalated to that role. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation or mass scanning - consistent with a flaw that depends on a privileged role rather than one that is broadly automatable. One point to verify: AV:N is justified only because the Test Connection/diagnostics feature actively transmits the stored bind password to an attacker-specified server address; the attack is therefore 'network' in effect but still gated behind an authenticated admin console action. Net: a credential-exposure weakness worth patching on a normal cycle, not a drop-everything event, given the privileged precondition and absence of exploitation signals.

A malicious or compromised System Console administrator (or an attacker who has already gained admin access) changes the AD/LDAP server address in the Mattermost admin console to a host they control, without re-entering the bind password. Because Mattermost fails to invalidate the previously stored bind password, triggering the Test Connection / diagnostics feature causes the server to send the still-stored plaintext bind credential to the attacker-controlled endpoint, where it is captured. No public exploit code was provided in the input.