{"id":"EUVD-2026-30752","enisaUuid":"d6400ebf-6017-39e1-8970-d80927c64968","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13, 11.4.x \u003c\u003d 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server credentials via the plaintext values present in the exported plugin configuration.. Mattermost Advisory ID: MMSA-2026-00605","datePublished":"May 18, 2026, 8:30:41 AM","dateUpdated":"May 18, 2026, 2:38:21 PM","baseScore":7.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2026-6347\nGHSA-82j6-4fq7-fx62\n","assigner":"Mattermost","epss":0.27,"enisaIdProduct":[{"id":"060fc484-d3ae-364c-9c8b-e2bb35a696d5","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"},{"id":"0f3ded00-74df-38ad-88dc-8594cb1ae8d7","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"},{"id":"f0950fb1-1ed1-31e6-ad38-927c109d6192","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.4.0 ≤11.4.3"}],"enisaIdVendor":[{"id":"e7bd6ad3-29a0-37fd-88b0-26bdf2980104","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"77489093-6edb-38d3-8cab-71e4a1f257db","vulnerability":{"id":"GHSA-82j6-4fq7-fx62","description":"Mattermost doesn\u0027t sanitize sensitive configuration fields in the Mattermost Calls plugin ","datePublished":"May 18, 2026, 9:31:48 AM","dateUpdated":"Jun 1, 2026, 3:44:49 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-6347\nhttps://github.com/mattermost/mattermost-plugin-calls/commit/d48893c8558e5a61f5fdd188bbee5ec7cb73887b\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30752\n","aliases":"GHSA-82j6-4fq7-fx62\nCVE-2026-6347\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"87f3a92b-4436-3d9e-948a-b45d6ddef410","vulnerability":{"id":"CVE-2026-6347","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13, 11.4.x \u003c\u003d 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server credentials via the plaintext values present in the exported plugin configuration.. Mattermost Advisory ID: MMSA-2026-00605","datePublished":"May 18, 2026, 8:30:41 AM","dateUpdated":"May 18, 2026, 2:38:21 PM","status":"PUBLISHED","baseScore":7.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30752\n","assigner":"Mattermost","epss":0.27,"dataProcessed":"Nov 7, 2026, 7:21:28 AM","vulnerabilityProduct":[{"id":"4ca171bd-fe3c-313e-9390-e363d5c9151f","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"},{"id":"800d3b2e-7bb3-37ce-8fb2-ec367fba6499","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.4.0 ≤11.4.3"},{"id":"c07c51e8-35f6-3517-b69b-1556a368c68c","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"}],"vulnerabilityVendor":[{"id":"401991e0-02a9-3bf6-b68e-e65585dfb6a4","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[]}