Description

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.6",
  "pubDate": "2026-08-17T23:16:52.820Z",
  "pubdate": "2026-08-17T23:16:52.820Z",
  "executiveSummary": "A sensitive information disclosure vulnerability exists in the Mattermost Desktop App versions <=6.2 6.2.2.0, where the application fails to properly redact the pre-auth secret during the generation of diagnostics reports. This flaw allows a local threat actor with access to the user's diagnostics report or underlying log files to extract the plaintext pre-auth secret configured for a connected server.\nThe vulnerability exposes sensitive authentication credentials that could potentially be leveraged to compromise server connectivity or facilitate further unauthorized interactions depending on the privileges associated with the pre-auth secret. Exploitation of this security issue requires local access to the victim's filesystem to inspect the generated diagnostics output, specifically within the Server Connectivity (Step-3) diagnostic logs.\nThe risk implication is moderate to high depending on local system security posture and multi-user environments where local privilege boundaries might be compromised. Remediation requires updating the affected Mattermost Desktop App to a secure version where pre-auth secrets are properly masked or redacted in all generated diagnostics reports and log files.",
  "technicalDetails": "The vulnerability resides in the diagnostics generation subsystem of the Mattermost Desktop App versions <=6.2 6.2.2.0. The root cause is an inadequate redaction implementation that fails to sanitize sensitive configuration parameters—specifically the pre-auth secret configured for connected servers—before writing diagnostic data to export files and log streams.\nDuring normal troubleshooting or automated telemetry generation, the application compiles various system states and configuration parameters into a diagnostics report. Within this reporting framework, the Server Connectivity (Step-3) diagnostics output records detailed connection parameters. Due to the missing sanitization filter, the plaintext pre-auth secret is serialized and written directly into these output files without obfuscation.\nThe attack flow requires an adversary to have local file system access to the targeted endpoint. This can occur via multi-user system access, compromised local user accounts, or unauthorized retrieval of exported diagnostic archives shared by a user. Once the adversary obtains the diagnostics report or corresponding log files, they can systematically parse the Server Connectivity (Step-3) output section.\nBy locating the unredacted configuration properties within the diagnostics text, the attacker extracts the plaintext pre-auth secret associated with the targeted server connection. No advanced authentication or elevated privileges are required on the Mattermost server itself, as the secret is harvested entirely from the client-side local artifacts. The post-exploitation impact includes the potential reuse of the harvested pre-auth secret against connected servers, depending on how the secret is validated and utilized within the broader infrastructure architecture."
}