EUVD-2026-30756
GHSA-wvgv-4fc3-2rcp
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Advisory ID: MMSA-2026-00614
AnalysisAI
Password disclosure in Mattermost Server versions 11.5.0-11.5.1, 10.11.0-10.11.13, and 11.4.0-11.4.3 allows high-privilege administrators to view newly created user credentials, enabling impersonation attacks. The CVSS score of 6.5 reflects medium severity, requiring high-privilege access (PR:H) but offering network-based exploitation (AV:N) with low complexity (AC:L). While not currently listed in CISA KEV and no public exploit identified at time of analysis, the vendor-confirmed vulnerability (Mattermost Advisory MMSA-2026-00614) presents real risk in environments where privileged accounts are compromised or insider threats exist.
Technical ContextAI
This vulnerability affects Mattermost Server, an open-source collaboration platform, across multiple release branches. The root cause is classified as CWE-522 (Insufficiently Protected Credentials), indicating the application fails to adequately protect user passwords during the account creation process. Based on the CPE identifier (cpe:2.3:a:mattermost:mattermost), the affected component is the core Mattermost server application. The flaw likely exists in the user management API or administrative interface where password generation or initial user setup occurs, allowing administrators with elevated privileges to access plaintext or insufficiently obfuscated passwords during user provisioning workflows. This represents a failure in credential lifecycle management, where sensitive authentication data is exposed to privileged users beyond operational necessity.
RemediationAI
Upgrade to patched Mattermost Server versions released after the affected ranges (specific fix versions not provided in available data-consult Mattermost Advisory MMSA-2026-00614 at https://mattermost.com/security-updates for exact patched versions). Until patching is feasible, implement compensating controls: restrict administrative account access using principle of least privilege, enable multi-factor authentication for all administrator accounts, implement comprehensive audit logging of all user creation activities with alerts for anomalous patterns, rotate credentials for any users created during the vulnerable period if administrator account compromise is suspected, and review administrator access logs for unauthorized user creation or password viewing activities. These mitigations reduce exploit likelihood by limiting the pool of accounts capable of exploitation but do not eliminate the underlying vulnerability-patching remains the definitive remediation. Credential rotation for affected users may cause temporary service disruption but is essential if breach indicators exist.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today