Mattermost versions up to 11.5.1, 10.11.13, and 11.4.3 do not properly sanitize sensitive configuration fields when generating support packets. The resulting support packets contain plaintext credentials, enabling anyone with access to download a support packet to obtain these credentials. This constitutes a direct confidentiality breach that could allow attackers to compromise integrations or bypass authentication mechanisms.

The vulnerable software is Mattermost Mattermost. Affected versions include 11.5.x versions up to and including 11.5.1, 10.11.x up to 10.11.13, and 11.4.x up to 11.4.3. Administrators or users with System Console access should verify their current patch level.

The CVSS score of 8.7 reflects a high severity. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog. Because the support packets are only accessible via the System Console, the likely attack vector involves an attacker who has gained access to the console or who has been granted permission to download support packets. Once a support packet is retrieved, the plaintext credentials can be extracted immediately, making exploitation quick and effective.