Mattermost 11.6.x through 10.11.x fail to sanitize the Remote Cluster API response on PATCH operations, exposing remote cluster authentication tokens to any authenticated user with the manage_secure_connections permission. This credential leakage allows an attacker who has authorized access to the Mattermost instance to obtain tokens that can authenticate to remote clusters, potentially facilitating unauthorized control or data exfiltration.

Mattermost Mattermost; affected versions are 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.15. The vulnerability is resolved in patched releases 11.7.0, 11.6.2, 11.5.5, 10.11.17 or any newer version.

The CVSS score of 6.5 signals a moderate severity risk. The EPSS score is not available and the vulnerability is not present in CISA's KEV catalog, suggesting limited exploitation in the wild. Exploitation requires an authenticated user with the manage_secure_connections permission, constraining the attack surface to privileged administrators. However, once credentials are leaked, an attacker could use them for lateral movement or unauthorized access to remote cluster resources.