Mattermost Desktop EUVD-2026-60543

Exploitation requires three concurrent conditions: first, the pre-auth secret feature must be configured on the connected Mattermost server - this is a non-default deployment option not universally enabled; second, the victim user must have generated a diagnostics report at some point using the affected Desktop App, producing a file that captures the plaintext secret in the Server Connectivity Step-3 section; third, the attacker must have local read access to this diagnostics report or associated log files, either via shared filesystem access, receiving the file from the user, or post-compromise file access. The UI:R metric in the CVSS vector limits exploitation to scenarios where the user has actively triggered diagnostics generation. Exploitation is further bounded by the pre-auth feature being non-universal in Mattermost deployments. What limits exploitation: the pre-auth secret feature must be explicitly configured (non-default), the user must have run diagnostics at least once, and the attacker requires physical or logical local access or social engineering to obtain the report file.

The CVSS base score of 3.6 (Low) accurately reflects real-world risk. The AV:L vector confirms exploitation is strictly local - the attacker must have physical or logical access to the machine or must receive the diagnostics file via some out-of-band channel. UI:R indicates the user must actively trigger diagnostics generation, further constraining the attack surface. The Scope:Changed (S:C) metric elevates the theoretical impact because the exposed secret affects the Mattermost server rather than only the local system. However, C:L with no integrity or availability impact caps the damage to credential disclosure alone. EPSS data was not provided, but given the narrow local-access constraint and non-default feature dependency (pre-auth secrets are not a universal deployment pattern), exploitation probability in practice is low. This is not listed in CISA KEV and has no known POC. The primary threat model is insider or post-compromise credential harvesting: an attacker who already has local access to the machine could use this to pivot to the Mattermost server. The PR:N assessment in the vendor vector is arguable - some degree of local presence is required - but is consistent with no elevated OS privileges being needed to read the file if permissions are permissive or the report is shared.

An attacker with read access to a shared workstation or who receives a forwarded diagnostics report from a Mattermost Desktop App user opens the Server Connectivity Step-3 section of the report and locates the pre-auth secret in plaintext. The attacker then uses this secret to configure their own client to authenticate against the victim's Mattermost server instance, bypassing the pre-auth access control layer. No public exploit code has been identified for this vulnerability.