Mattermost versions 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3 fail to prevent the disclosure of newly created user passwords. The vulnerability enables a malicious actor who obtains any of the exposed passwords to impersonate users by logging in with those credentials. The weakness is categorized as CWE-522, which denotes an information exposure through credential disclosure.

The affected system is Mattermost’s collaboration platform, specifically the community or enterprise editions running the vulnerable versions listed above. Administrators should verify whether their installations belong to the affected series (11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3).

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local to the Mattermost installation, requiring access to user command or API capabilities that trigger the Slack import process. An attacker with administrative or privileged API permissions could exploit the fault to extract passwords and subsequently impersonate users, leading to potential data compromise or unauthorized actions within the workspace.