CVE-2023-5968

CVE-2023-5968 describes a vulnerability in Mattermost where the user object is not properly sanitized during username updates, leading to the exposure of the password hash in the response body. This medium-severity vulnerability (CVSS 4.9) has a network attack vector and low attack complexity, allowing a highly privileged attacker to gain access to sensitive password hashes, though without impacting integrity or availability. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.