PT-2026-25680 · Mattermost · Teams Plugin+1

Yash-Chakerverti · Published 2026-03-16 · Updated 2026-03-27 · CVE-2026-2476

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Plugins versions through 2.0.3.0

Description The Mattermost plugins do not properly mask sensitive configuration values. This allows an attacker with access to support packets to obtain original plugin settings through exported configuration data. The Mattermost Microsoft Teams Plugin is also affected.

Recommendations Update to a version of Mattermost Plugins greater than 2.0.3.0.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-2476

GHSA-4PPJ-6CHV-5PGC

GO-2026-4784

SUSE-SU-2026:1135-1

Affected Products

Mattermost Plugins

Teams Plugin

References · 150

• https://osv.dev/vulnerability/GHSA-4ppj-6chv-5pgc · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4784 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2476 · Security Note
• https://github.com/mattermost/mattermost-plugin-msteams · Note
• https://github.com/mattermost/mattermost-plugin-msteams/commit/036c761bd3cb9ece92c17f2b151dfa906cebdcf6 · Note
• https://suse.com/security/cve/CVE-2026-33217 · Note
• https://suse.com/security/cve/CVE-2026-33216 · Note
• https://suse.com/security/cve/CVE-2026-32768 · Note
• https://suse.com/security/cve/CVE-2026-32747 · Note
• https://suse.com/security/cve/CVE-2026-2463 · Note
• https://suse.com/security/cve/CVE-2026-30886 · Note
• https://suse.com/security/cve/CVE-2026-33219 · Note