Mattermost server versions 11.3.x (<=11.3.0), 11.2.x (<=11.2.2), and 10.11.x (<=10.11.10) fail to restrict plugin installation on Continuous Integration test instances that use default administrator credentials. The vulnerability allows an unauthenticated attacker to upload a malicious plugin after changing the import directory, which results in remote code execution and the exfiltration of sensitive configuration data such as AWS and SMTP credentials. The weakness is identified as CWE-863, indicating unauthorized access to privileged code execution paths.

Affected systems are Mattermost servers running the identified vulnerable versions. The product affected is the Mattermost server, and specific affected versions are 11.3.x up to and including 11.3.0, 11.2.x up to and including 11.2.2, and 10.11.x up to and including 10.11.10.

The CVSS score of 6.6 reflects a moderate severity level, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The attack vector is inferred to be unauthenticated, as the description states that an attacker need only default admin credentials on a CI test instance to deploy the malicious plugin.