CVE-2026-6345
published 2026-05-18CVE-2026-6345: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker…
PriorityP338medium6.5CVSS 3.1
AVNACLPRHUINSUCHIHAN
EPSS
0.23%
14.0th percentile
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Advisory ID: MMSA-2026-00614
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 0 < 5.3.2-0.20260311102650-3057ae7e83e9 | 5.3.2-0.20260311102650-3057ae7e83e9 |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20260311102650-3057ae7e83e9 | 8.0.0-20260311102650-3057ae7e83e9 |
| github.com | mattermost_mattermost_server_v8 | >= 10.11.0 < 10.11.14 | 10.11.14 |
| github.com | mattermost_mattermost_server_v8 | >= 11.4.0 < 11.4.4 | 11.4.4 |
| github.com | mattermost_mattermost_server_v8 | >= 11.5.0 < 11.5.2 | 11.5.2 |
| mattermost | mattermost | 10.11.0 – 10.11.13 | — |
| mattermost | mattermost | 11.4.0 – 11.4.3 | — |
| mattermost | mattermost | 11.5.0 – 11.5.1 | — |
| mattermost | mattermost_server | >= 10.11.0 < 10.11.14 | 10.11.14 |
| mattermost | mattermost_server | >= 11.4.0 < 11.4.4 | 11.4.4 |
| mattermost | mattermost_server | >= 11.5.0 < 11.5.2 | 11.5.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Mattermost up to 10.11.13/11.4.3/11.5.1/11.5.x insufficiently protected credentials (EUVD-2026-30756)
vuldb·2026-05-18·CVSS 6.5
CVE-2026-6345 [MEDIUM] Mattermost up to 10.11.13/11.4.3/11.5.1/11.5.x insufficiently protected credentials (EUVD-2026-30756)
A vulnerability was found in Mattermost up to 10.11.13/11.4.3/11.5.1/11.5.x. It has been declared as problematic. This affects an unknown part. Such manipulation leads to insufficiently protected credentials.
This vulnerability is traded as CVE-2026-6345. The attack may be launched remotely. There is no exploit available.
It is recommended to upgrade the affected component.
GHSA
GHSA-wvgv-4fc3-2rcp: Mattermost versions 11
ghsa_unreviewed·2026-05-18
CVE-2026-6345 [MEDIUM] CWE-522 GHSA-wvgv-4fc3-2rcp: Mattermost versions 11
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Advisory ID: MMSA-2026-00614
GHSA
Mattermost doesn't prevent disclosure of created user password
ghsa·2026-05-18
CVE-2026-6345 [MEDIUM] CWE-522 Mattermost doesn't prevent disclosure of created user password
Mattermost doesn't prevent disclosure of created user password
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 doesn't prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Advisory ID: MMSA-2026-00614
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-18
Published