CVE-2016-11078

6.5 mediumEPSS 0.9%

An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2020-06-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mattermost:mattermost_server

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-9w4v-9c99-hv7r	Go	github.com/mattermost/mattermost-server	<3.0.0	3.0.0
GO-2025-4057	Go	github.com/mattermost/mattermost-server	<3.0.0+incompatible	3.0.0+incompatible

References

https://mattermost.com/security-updates/
https://mattermost.com/security-updates/

Check your stack JSON