Mattermost servers that run with debug‑level logging write full authentication tokens into the server log for every failed login attempt. An adversary who can read these logs can obtain valid session or OAuth access tokens and then impersonate the corresponding user, effectively gaining unauthorized access to Mattermost resources.

All instances of the Mattermost server running versions 11.9.x up to and including 11.9.1, 11.8.x up to 11.8.5, 11.7.x up to 11.7.10, and 11.10.x up to 11.10.1 are affected. The affected product is the Mattermost server component supplied by Mattermost.

The CVSS score of 4.5 indicates moderate severity. The EPSS score is less than 1%, signifying a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to obtain access to the server logs while debug‑level logging is enabled. An attacker with such access can retrieve tokens and impersonate users, although exploitation requires privileged access to the logging environment.