{"id":"EUVD-2026-30754","enisaUuid":"c0014b19-594a-3947-bfbb-941525548794","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13, 11.4.x \u003c\u003d 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet to obtain sensitive credentials in plaintext via downloading a support packet from the System Console.. Mattermost Advisory ID: MMSA-2026-00607","datePublished":"May 18, 2026, 8:37:10 AM","dateUpdated":"May 18, 2026, 2:37:17 PM","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2026-6346\nGHSA-9p64-jpc7-m2rp\n","assigner":"Mattermost","epss":0.3,"enisaIdProduct":[{"id":"060ea7b4-860a-368d-b849-5e763a53bf7b","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"},{"id":"1c9210ef-6787-3417-ab18-ca0e75041372","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"},{"id":"a63b59fa-8a80-3eab-b31d-b7030e45c8e5","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.4.0 ≤11.4.3"}],"enisaIdVendor":[{"id":"4bcfeaa6-7cdb-3da6-826d-65fa62459f00","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"30fa2c1c-6b0d-39e4-a7c1-20c186311d44","vulnerability":{"id":"GHSA-9p64-jpc7-m2rp","description":"Mattermost doesn\u0027t sanitize sensitive configuration fields before including them in support packet generation","datePublished":"May 18, 2026, 9:31:48 AM","dateUpdated":"Jun 1, 2026, 3:41:08 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-6346\nhttps://github.com/mattermost/mattermost/commit/fac92f4a71f356009e27983a980f729f599e8ba5\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30754\n","aliases":"CVE-2026-6346\nGHSA-9p64-jpc7-m2rp\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:48:27 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ca7e617b-8eab-3f34-9142-40bab26ab1e5","vulnerability":{"id":"CVE-2026-6346","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13, 11.4.x \u003c\u003d 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet to obtain sensitive credentials in plaintext via downloading a support packet from the System Console.. Mattermost Advisory ID: MMSA-2026-00607","datePublished":"May 18, 2026, 8:37:10 AM","dateUpdated":"May 18, 2026, 2:37:17 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30754\n","assigner":"Mattermost","epss":0.3,"dataProcessed":"Nov 9, 2026, 7:17:04 AM","vulnerabilityProduct":[{"id":"32cf48fe-d5c7-3515-b4eb-9910150b3128","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"},{"id":"66cbba56-0529-3c77-be42-04255313f353","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.4.0 ≤11.4.3"},{"id":"87a12e22-81b2-39fa-9c93-cb4d0e427937","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"}],"vulnerabilityVendor":[{"id":"55ef5765-4ac6-37ae-b32d-706951b29786","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[]}