CVE-2026-75587 affects Mattermost Desktop App versions up to 6.2.2.0, where the application fails to redact the pre-authentication secret when generating diagnostics reports. A local attacker who can access a user's diagnostics report or log files can extract the plaintext pre-auth secret by inspecting the Server Connectivity diagnostics output. This information disclosure vulnerability is categorized under CWE-200 (Exposure of Sensitive Information). The CVSS v3.1 score is 3.6, indicating low severity, with attack vector local, low complexity, no privileges required, user interaction required, scope changed, and confidentiality impact low.

The vulnerability allows a local attacker with access to diagnostics reports or log files to obtain sensitive pre-authentication secrets in plaintext. This could potentially lead to unauthorized access to connected servers if the secret is used for authentication. However, the impact is limited to confidentiality and requires local access and user interaction, resulting in a low overall severity.

Patch status is not yet confirmed — check the vendor advisory (Mattermost Advisory ID: MMSA-2026-00716) for current remediation guidance. Until a fix is available, restrict local access to diagnostics reports and log files to trusted users only to prevent unauthorized disclosure of the pre-auth secret.