CVE-2026-75587
LowCVSS 3.6Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Mattermost Desktop App versions <=6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, allowing a local attacker with access to the report or log files to obtain the plaintext pre-auth secret via inspecting the Server Connectivity (Step-3) diagnostics output.
Risk Assessment
The risk is exposure of the pre-auth secret, potentially enabling an attacker to compromise the connected server or access sensitive data.
Recommendation
Update the Mattermost Desktop App to a patched version and be cautious when sharing diagnostic reports.
Original NVD description (English source)
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716