CVE-2026-6345 — Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13,

title: CVE-2026-6345 - Mattermost User Password Disclosure via API
id: scw-2026-05-18-ai-1
status: experimental
level: critical
description: |
  This rule detects potential exploitation of CVE-2026-6345 by identifying API calls to '/api/v4/users' that include 'password' and 'created_at' in the query parameters. This specific pattern suggests an attempt to retrieve user information, potentially including exposed passwords due to the vulnerability in affected Mattermost versions.
author: SCW Feed Engine (AI-generated)
date: 2026-05-18
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6345/
tags:
  - attack.credential_access
  - attack.t1078.004
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/v4/users'
      cs-method:
          - 'POST'
      sc-status:
          - '200'
      cs-uri-query|contains:
          - 'password'
  selection_base:
      cs-uri|contains:
          - '/api/v4/users'
  selection_indicators:
      cs-uri-query|contains:
          - 'created_at'
  condition: selection_base AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse