CVE-2026-75587 in Desktop App
Summary
by MITRE • 08/18/2026
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in Mattermost Desktop App versions 6.2 and earlier, specifically up to version 6.2.2.0, represents a critical information disclosure flaw rooted in improper handling of sensitive authentication credentials during the diagnostic data generation process. This issue is classified under CWE-532, which pertains to the inclusion of sensitive information in log files or diagnostics output. The core technical failure lies within the application's internal mechanism for collecting system and connectivity metrics to assist users and administrators in troubleshooting connection issues. During this collection phase, the software captures detailed network interaction data, including a specific segment labeled Server Connectivity Step-3. In this step, the application inadvertently includes the plaintext pre-auth secret associated with the user's connected Mattermost server instance within the generated diagnostic report or log file. This oversight occurs because the sanitization routines that typically strip sensitive tokens from output streams were either absent for this specific data path or incorrectly implemented, allowing confidential cryptographic material to persist in plain text format on the local filesystem.
The operational impact of this vulnerability is significant due to its reliance on local access rather than remote exploitation. A threat actor who gains physical or logical access to a user's workstation can exploit this flaw without needing to bypass network security controls such as firewalls or intrusion detection systems. By navigating to the directory where Mattermost stores its diagnostic logs and opening the relevant file, an attacker can easily locate the Server Connectivity section of the report. The presence of the plaintext pre-auth secret allows the adversary to authenticate directly to the connected Mattermost server without requiring a password or multi-factor authentication bypass, effectively granting them full access to the user's account. This level of access enables the exfiltration of private messages, files, and organizational data stored within that workspace. Furthermore, because the vulnerability affects multiple versions in the 6.x series, it poses a widespread risk to organizations relying on these specific builds for their desktop communication infrastructure, potentially leading to severe confidentiality breaches and compliance violations depending on the sensitivity of the exchanged information.
From an offensive security perspective, this flaw aligns with ATT&CK technique T1005, which describes Data from Local System, specifically through file and directory discovery followed by data staging or exfiltration via local logs. The attack vector is straightforward: once a user opens the diagnostic report to share it for support purposes or reviews their own connection status, they inadvertently expose credentials that can be harvested by any process running with read access to those files. This highlights a broader industry challenge where convenience features like automated diagnostics are not sufficiently audited against security best practices regarding credential handling. The failure to redact secrets before writing them to disk violates the principle of least privilege and minimal data retention, as sensitive authentication material should never be persisted in readable formats unless absolutely necessary for immediate processing, and even then, it must be encrypted or hashed appropriately.
Mitigation strategies require both immediate remediation by software vendors and proactive measures by end-users and system administrators. The primary solution is to upgrade the Mattermost Desktop App to version 6.2.3 or later, where this specific logging flaw has been addressed in subsequent releases following Advisory ID MMSA-2026-00716. For organizations unable to update immediately due to compatibility constraints, it is crucial to restrict file system permissions on the Mattermost application data directories so that only authorized administrative accounts can read diagnostic logs. Additionally, users should be educated to avoid sharing full diagnostic reports with untrusted parties and to manually verify such files for sensitive content before distribution. Security teams should also implement monitoring solutions capable of detecting unusual access patterns to log files or the presence of known credential formats in plaintext within local directories, providing an additional layer of defense against potential exploitation by malicious insiders or malware residing on compromised endpoints.