# CVE-2026-6345: Mattermost password disclosure in user creation Source: https://junglewise.ai/threats/cve-2026-6345-mattermost-password-disclosure-in-user-creation Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-05-18. Updated: 2026-06-01 License: CC BY 4.0 with a link back CVE-2026-6345 · Severity: medium · CVSS 6.5 · Published 2026-05-18 Mattermost, a collaboration and messaging platform, contains a security flaw that could allow an attacker to discover user passwords. By obtaining these credentials, a malicious actor could impersonate legitimate users, potentially gaining unauthorized access to sensitive internal communications and private data. This issue primarily affects specific versions of the Mattermost server during certain user creation or import processes. Technologies: [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server), [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5), [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6), [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8), [Mattermost Server](https://junglewise.ai/threats/technologies/server-public). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Mattermost](https://junglewise.ai/threats/vendors/mattermost). ## Quick answers **Is CVE-2026-6345 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6345 being exploited in the wild. **How severe is CVE-2026-6345?** Medium severity, with a CVSS score of 6.5, published 18 May 2026. **Which products and versions are affected?** github.com/mattermost/mattermost-server (Go) SEMVER:introduced=0,fixed=5.3.2-0.20260311102650-3057ae7e83e9, SEMVER:introduced=10.11.0+incompatible,fixed=10.11.14+incompatible,introduced=11.4.0+incompatible,fixed=11.4.4+incompatible,introduced=11.5.0+incompatible,fixed=11.5.2+incompatible; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=0,fixed=8.0.0-20260311102650-3057ae7e83e9, SEMVER:introduced=11.5.0,fixed=11.5.2; and 1 more. **Is there a fix for CVE-2026-6345?** Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.5.2+incompatible, 5.3.2-0.20260311102650-3057ae7e83e9 or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 11.5.2, 8.0.0-20260311102650-3057ae7e83e9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-6345 attacked?** It is attacked over the network, in a network appliance. **Am I affected by CVE-2026-6345?** Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - github.com/mattermost/mattermost-server (Go): upgrade to 11.5.2+incompatible, 5.3.2-0.20260311102650-3057ae7e83e9 or later ```sh go get github.com/mattermost/mattermost-server@v11.5.2+incompatible ``` - github.com/mattermost/mattermost/server/v8 (Go): upgrade to 11.5.2, 8.0.0-20260311102650-3057ae7e83e9 or later ```sh go get github.com/mattermost/mattermost/server/v8@v11.5.2 ``` ## Technical details Mattermost Server is vulnerable to credential disclosure (CWE-522) in versions 11.5.x, 11.4.x, and 10.11.x. The root cause involves the failure to prevent the disclosure of created user passwords, particularly during processes like Slack imports. An attacker with high privileges (PR:H) can exploit this over the network to retrieve or intercept passwords, enabling user impersonation. The fix, as seen in commit 3057ae7, involves improving the Slack import flow to add users without pre-set passwords and forcing a password reset flow instead. Patches are available in versions 11.5.2, 11.4.4, and 10.11.14. ## Affected products - Mattermost Mattermost Server 11.5.0 - 11.5.1, 11.4.0 - 11.4.3, 10.11.0 - 10.11.13, and versions prior to 8.0.0-20260311102650-3057ae7e83e9 ## Identifiers - CVE-2026-6345 - GHSA-wvgv-4fc3-2rcp - GO-2026-5727 ## Timeline - 2026-03-11: patched: Fix commit 3057ae7e83e9c827ce7818d67c0f3a208f0d9709 authored - 2026-05-18: disclosed: NVD and GitHub Advisory published ## References - [https://mattermost.com/security-updates](https://mattermost.com/security-updates) - [https://github.com/mattermost/mattermost/commit/3057ae7e83e9c827ce7818d67c0f3a208f0d9709](https://github.com/mattermost/mattermost/commit/3057ae7e83e9c827ce7818d67c0f3a208f0d9709) ## Related threats - [Mattermost CSRF via Agents plugin mention reminder validation](https://junglewise.ai/threats/cve-2026-93851-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10) - [Mattermost denial of service via PDF text extraction memory exhaustion](https://junglewise.ai/threats/cve-2026-93850-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11) - [Mattermost denial of service in WebSocket msgpack decoder](https://junglewise.ai/threats/cve-2026-93849-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11) - [Mattermost information disclosure in post deletion events](https://junglewise.ai/threats/cve-2026-19621-mattermost-versions-11-10-x-11-10-0-11-7-x-11-7-9-11-9-x-11-9-1) - [Mattermost authentication token leak in server logs](https://junglewise.ai/threats/cve-2026-19600-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)