PT-2026-25680 · Mattermost · Teams Plugin+1

Yash-Chakerverti · Publicado 2026-03-16 · Atualizado 2026-03-27 · CVE-2026-2476

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Plugins versions through 2.0.3.0

Description The Mattermost plugins do not properly mask sensitive configuration values. This allows an attacker with access to support packets to obtain original plugin settings through exported configuration data. The Mattermost Microsoft Teams Plugin is also affected.

Recommendations Update to a version of Mattermost Plugins greater than 2.0.3.0.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-2476

GHSA-4PPJ-6CHV-5PGC

GO-2026-4784

SUSE-SU-2026:1135-1

Produtos afetados

Mattermost Plugins

Teams Plugin

Referências · 150

• https://github.com/mattermost/mattermost-plugin-msteams · Nota
• https://github.com/mattermost/mattermost-plugin-msteams/commit/036c761bd3cb9ece92c17f2b151dfa906cebdcf6 · Nota
• https://suse.com/security/cve/CVE-2026-33217 · Nota
• https://suse.com/security/cve/CVE-2026-33216 · Nota
• https://suse.com/security/cve/CVE-2026-32768 · Nota
• https://suse.com/security/cve/CVE-2026-32747 · Nota
• https://suse.com/security/cve/CVE-2026-2463 · Nota
• https://suse.com/security/cve/CVE-2026-30886 · Nota
• https://suse.com/security/cve/CVE-2026-33219 · Nota
• https://suse.com/security/cve/CVE-2026-33322 · Nota
• https://twitter.com/pulsepatchio/status/2036460507545346342 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-33622 · Nota
• https://suse.com/security/cve/CVE-2026-33528 · Nota
• https://suse.com/security/cve/CVE-2026-24692 · Nota
• https://suse.com/security/cve/CVE-2026-32301 · Nota