Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Mattermost server versions 11.5.0 through 11.5.1, 10.11.0 through 10.11.13, and 11.4.0 through 11.4.3 do not prevent disclosure of a created user's password. An attacker may be able to use some of these disclosed passwords to impersonate a user. The source does not say what access the attacker needs. Upgrade github.com/mattermost/mattermost/server/v8 to 10.11.14, 11.4.4, or 11.5.2, or to the matching fixed version for your release line. Older branch 8.0.0 and github.com/mattermost/mattermost-server users should upgrade to the listed fixed version.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.5 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N | CNA (Mattermost) |
- CISA KEV Not listed.
- EPSS 0.0023, the 14th percentile, on 11 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:06 UTC First seen by agentprime
- 31 Oct 2026, 15:06 UTC Confirmed by OSV