CVE-2026-75587 — Plaintext pre-auth secret exposure via Desktop App diagnostics report
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diag…
Published: 2026-08-17 · CVSS: 3.6 · CVSS 3.1
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7