6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-6345

CVE-2026-6345: Mattermost doesn't prevent disclosure of created user password

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 doesn't prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Advisory ID: MMSA-2026-00614

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-6345

CVE-2026-6345:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost/server/v8	go	>= 10.11.0, < 10.11.14	10.11.14
github.com/mattermost/mattermost/server/v8	go	>= 11.4.0, < 11.4.4	11.4.4
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20260311102650-3057ae7e83e9	8.0.0-20260311102650-3057ae7e83e9
github.com/mattermost/mattermost-server	go	< 5.3.2-0.20260311102650-3057ae7e83e9	5.3.2-0.20260311102650-3057ae7e83e9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability existed within Mattermost's Slack import functionality. When users were imported from a Slack export, the system would generate new passwords for them. The functions SlackImporter.slackAddUsers and SlackImporter.slackAddBotUser were responsible for creating these users and their passwords. The core of the vulnerability is that these functions would then write the newly generated passwords to a log file. An attacker with access to these logs could retrieve the passwords and impersonate the imported users. The entry point for this vulnerable operation is the App.SlackImport function, which handles the API request for the import.

The patch rectifies this by removing the password generation and logging. Instead of creating a password, the user is created with an empty password, and a password reset process is initiated by sending them an email. This ensures that no passwords are ever logged, mitigating the information disclosure vulnerability.

Vulnerable functions

SlackImporter.slackAddUsers

server/platform/services/slackimport/slackimport.go

This function created a new user during a Slack import, generated a password for them, and then logged the password, exposing credentials.

SlackImporter.slackAddBotUser

server/platform/services/slackimport/slackimport.go

Similar to slackAddUsers, this function created a bot user and logged its generated password, leading to credential disclosure.

App.SlackImport

server/channels/app/slack.go

This is the entrypoint function that initiates the Slack import process. The patch adds the `SendPasswordReset` action, which is a core part of the mitigation to no longer generate and log passwords. Exploitation of the vulnerability would involve a call to the API endpoint handled by this function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.