PT-2026-41661 · Mattermost · Mattermost Calls+1

Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-6347

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13 Mattermost versions 11.4.0 through 11.4.3

Description The Mattermost Calls plugin fails to sanitize sensitive configuration fields. This allows an attacker who has access to a support packet to obtain TURN server credentials, as the values are present in plaintext within the exported plugin configuration.

Recommendations Update Mattermost versions 11.5.0 through 11.5.1 to a version newer than 11.5.1. Update Mattermost versions 10.11.0 through 10.11.13 to a version newer than 10.11.13. Update Mattermost versions 11.4.0 through 11.4.3 to a version newer than 11.4.3.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-6347

GHSA-82J6-4FQ7-FX62

Affected Products

Mattermost

Mattermost Calls

References · 8

• https://osv.dev/vulnerability/GHSA-82j6-4fq7-fx62 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6347 · Security Note
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost-plugin-calls/commit/d48893c8558e5a61f5fdd188bbee5ec7cb73887b · Note
• https://twitter.com/CVEarity/status/2056408600122442235 · Twitter Post
• https://t.me/CVEtracker/54121 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6347 · Note