Riskcovery

CVE-2026-75587

Plaintext pre-auth secret exposure via Desktop App diagnostics report

State
Published
Severity
3.6 Low
Published
Aug 17, 2026
Updated
Aug 18, 2026
Reserved
Aug 17, 2026

Read the record on cve.org

Description

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716

Scores

CVSSScoreVectorSource
3.13.6 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:NMattermost

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
MattermostMattermost
  • 6.2.2 and earlierAffected
  • 6.3.0Not affected
  • 6.2.3.0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.