The vulnerability occurs when the Mattermost Calls plugin fails to sanitize sensitive configuration fields. Exported plugin configuration in support packets contains plaintext TURN server credentials, allowing an attacker who can access a support packet to obtain these credentials. Availability is not directly impacted, but confidentiality and integrity of the TURN service can be compromised, potentially enabling traffic interception or manipulation.

Mattermost’s Mattermost Calls plugin is affected in the following versions: 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3.

The CVSS score of 7.6 categorises the flaw as high severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV database, suggesting no known widespread exploitation. The attack vector requires an adversary who can access a support packet, which typically implies either local or remote privileged access or the ability to intercept support traffic. Because the exposed credentials grant the attacker direct authentication to the TURN server, the impact can be significant if the TURN server is used for real‑time communication. Prompt patching mitigates the risk.