CVE-2026-6345: Prevent password disclosure and force reset during Slack import
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Advisory ID: MMSA-2026-00614
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.5.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.14 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.4.4 - Compensating control
During Slack import, prevent password disclosure and force users to reset passwords to mitigate the created-user password disclosure and resulting impersonation risk.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6345?
CVE-2026-6345 is classified as a high severity vulnerability due to the potential for password disclosure and user impersonation.
How do I fix CVE-2026-6345?
To fix CVE-2026-6345, update your Mattermost installation to version 11.5.2, 10.11.14, or 11.4.4 or later.
What versions of Mattermost are affected by CVE-2026-6345?
CVE-2026-6345 affects Mattermost versions 11.5.x up to 11.5.1, 10.11.x up to 10.11.13, and 11.4.x up to 11.4.3.
What are the risks associated with CVE-2026-6345?
The risks associated with CVE-2026-6345 include unauthorized user impersonation and potential data breaches.
Is there a workaround for CVE-2026-6345 until I can update?
There is no official workaround for CVE-2026-6345, and it is recommended to update to a fixed version as soon as possible.