The vulnerability resides in Mattermost Teams plugins up to version 2.0.3.0, where sensitive configuration values are not properly masked before being exported in support packets. An attacker who can access these packets can retrieve the original plugin settings, potentially exposing credentials, tokens, or other confidential data. The weakness belongs to the CWE-200 class, emphasizing unauthorized disclosure of information.

Mattermost’s MS Teams plugins, specifically any installations running versions 2.0.3.0 or earlier, are affected. The issue impacts the Mattermost product as a whole, as the plugin configuration is part of its exported support data.

The CVSS score of 7.6 indicates high severity, while an EPSS score below 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation yet. The attack vector is inferred to be local or remote depending on an attacker’s ability to obtain support packets, which generally requires privileged access or a supply chain compromise. Once the packet is accessed, the attacker can read the unmasked settings, leading to potential credential compromise and further attacks.