CVE-2026-20796 PUBLISHED CVSS 3.0999999046325684 LOW

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560

EPSS 0.01% · 1.2th percentile

Risk Scores

CVSS v3.1
3.0999999046325684
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.01%
1.2th percentile

Affected Products

VendorProductVersions
mattermostmattermost_server10.11.0
MattermostMattermost10.11.0, 10.11.10, 11.3.0
github.commattermost/mattermost-server10.11.0

Timeline

References

Open in Interactive Console →