CVE-2025-13321: Mattermost Desktop App information disclosure in logs

CVE-2025-13321 · Severity: low · CVSS 3.3 · Published 2025-12-17

Mattermost Desktop App, a client application used to connect to Mattermost team communication servers, fails to remove sensitive information from its application logs and does not clear session data when servers are removed. An attacker with local access to a user's computer could read these logs to obtain potentially sensitive credentials or authentication tokens, compromising the user's account and data on connected servers.

Technologies: Mattermost Desktop App. Vendors: Mattermost.

Quick answers

Is CVE-2025-13321 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-13321 being exploited in the wild.
How severe is CVE-2025-13321?
Low severity, with a CVSS score of 3.3, published 17 December 2025.
Which products and versions are affected?
Mattermost Desktop App < 6.0.0.
Is there a fix for CVE-2025-13321?
A patch was published on 2025-09-22: Fix committed to repository; npm registry publication status unclear at advisory time Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-13321 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2025-13321?
Check whether you run Mattermost Desktop App or Mattermost Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure issue (CWE-532: Insertion of Sensitive Information into Log Files) affecting Mattermost Desktop App versions prior to 6.0.0. The application fails to sanitize sensitive information (such as authentication tokens and credentials) from its logs and does not clear server session data when a server connection is deleted. The attack vector is local and requires an attacker to have access to the affected user's system to read the log files. An attacker can exploit this to retrieve sensitive authentication material or session tokens. A fix is available in the Mattermost Desktop repository (commit 722938bb6a97e8b8a5678e6858e44c4d505c08ee), though it had not been published to the npm registry at the time of advisory publication.

Affected products

  • Mattermost Desktop App < 6.0.0

Identifiers

  • CVE-2025-13321
  • GHSA-g6qx-wq5w-wr8v

Timeline

  • 2025-12-17: disclosed
  • 2025-09-22: patched: Fix committed to repository; npm registry publication status unclear at advisory time

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.