Executive brief
Mattermost Desktop App, a client application used to connect to Mattermost team communication servers, fails to remove sensitive information from its application logs and does not clear session data when servers are removed. An attacker with local access to a user's computer could read these logs to obtain potentially sensitive credentials or authentication tokens, compromising the user's account and data on connected servers.
Technical details
The vulnerability is an information disclosure issue (CWE-532: Insertion of Sensitive Information into Log Files) affecting Mattermost Desktop App versions prior to 6.0.0. The application fails to sanitize sensitive information (such as authentication tokens and credentials) from its logs and does not clear server session data when a server connection is deleted. The attack vector is local and requires an attacker to have access to the affected user's system to read the log files. An attacker can exploit this to retrieve sensitive authentication material or session tokens. A fix is available in the Mattermost Desktop repository (commit 722938bb6a97e8b8a5678e6858e44c4d505c08ee), though it had not been published to the npm registry at the time of advisory publication.
Affected products
- Mattermost Desktop App < 6.0.0
Timeline
- 2025-12-17: disclosed
- 2025-09-22: patched: Fix committed to repository; npm registry publication status unclear at advisory time