Vulnerability · Published Aug 17, 2026 · Assigned by Mattermost

CVE-2026-75587Plaintext pre-auth secret exposure via Desktop App diagnostics report

Low 3.6

In plain English

A low-severity information exposure in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)3.6Low

Exploit odds (30 days)0.1%top 97.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	0 – through 6.2.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

References

MMSA-2026-00716 vendor-advisory