CVE-2026-6345 - Prevent password disclosure and force reset during Slack import

Back Back to CVE browser

MEDIUM

Prevent password disclosure and force reset during Slack import

Published May 18, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.39%

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Advisory ID: MMSA-2026-00614

Affected products

Vendor Mattermost Product Mattermost Default
unaffected
- Version
  10.11.0
  Status
  affected
  Constraints
  <=10.11.13
- Version
  11.4.0
  Status
  affected
  Constraints
  <=11.4.3
- Version
  11.5.0
  Status
  affected
  Constraints
  <=11.5.1
- Version
  10.11.14
  Status
  unaffected
  Constraints
  -
- Version
  11.4.4
  Status
  unaffected
  Constraints
  -
- Version
  11.5.2
  Status
  unaffected
  Constraints
  -
- Version
  11.6.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mattermost

unaffected

Version	Status	Constraints
10.11.0	affected	<=10.11.13
11.4.0	affected	<=11.4.3
11.5.0	affected	<=11.5.1
10.11.14	unaffected	-
11.4.4	unaffected	-
11.5.2	unaffected	-
11.6.0	unaffected	-

github.com/mattermost/mattermost/server/v8

Go

Introduced 0 Fixed 8.0.0-20260311102650-3057ae7e83e9
github.com/mattermost/mattermost-server/v5

Go

Introduced 0 Fixed not fixed
github.com/mattermost/mattermost-server/v6

Go

Introduced 0 Fixed not fixed
github.com/mattermost/mattermost-server

Go

Introduced 10.11.0+incompatible Fixed 10.11.14+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 11.4.0+incompatible Fixed 11.4.4+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 11.5.0+incompatible Fixed 11.5.2+incompatible

Ecosystem	Package	Introduced	Fixed
Go	github.com/mattermost/mattermost/server/v8	0	8.0.0-20260311102650-3057ae7e83e9
Go	github.com/mattermost/mattermost-server/v5	0	not fixed
Go	github.com/mattermost/mattermost-server/v6	0	not fixed
Go	github.com/mattermost/mattermost-server	10.11.0+incompatible	10.11.14+incompatible
Go	github.com/mattermost/mattermost-server	11.4.0+incompatible	11.4.4+incompatible
Go	github.com/mattermost/mattermost-server	11.5.0+incompatible	11.5.2+incompatible

Remediation

Vendor solution

Update Mattermost to versions 11.6.0, 11.5.2, 10.11.14, 11.4.4 or higher.

Weaknesses (1)

CWE-522

Insufficiently Protected Credentials

References (4)

https://github.com/advisories/GHSA-wvgv-4fc3-2rcp
Advisory
https://github.com/mattermost/mattermost/commit/3057ae7e83e9c827ce7818d67c0f3a208f0d9709
https://mattermost.com/security-updates
vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6345

Link	Providers	Tags
https://github.com/advisories/GHSA-wvgv-4fc3-2rcp		Advisory
https://github.com/mattermost/mattermost/commit/3057ae7e83e9c827ce7818d67c0f3a208f0d9709
https://mattermost.com/security-updates		vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6345