Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 34

Export CSV
CVE-2026-75025

Mattermost Desktop local network access from server-rendered content

Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy. Mattermost Advisory ID: MMSA-2026-00698

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2026-12284

Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Mattermost Advisory ID: MMSA-2026-00699

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2026-75588

Mattermost Desktop App plugin popout scheme validation bypass

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Mattermost Advisory ID: MMSA-2026-00717

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2026-75587

Plaintext pre-auth secret exposure via Desktop App diagnostics report

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2026-9602

Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods

Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash the Mattermost Desktop App via changing the payload of a method to a malformed one. Mattermost Advisory ID: MMSA-2026-00678

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2026-8075

Posting a malicious markdown image crashes the Mattermost Desktop App

Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a malicious link with an embedded image that misses one of those headers. Mattermost Advisory ID: MMSA-2026-00668

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2026-8683

Overly long URLs crash the Mattermost Desktop App

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a script to call window.open on a very large URL. Mattermost Advisory ID: MMSA-2026-00652

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2026-6517

Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that routes to an external web server. Mattermost Advisory ID: MMSA-2026-00651

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2026-4643

Calling window.close() from server-side content causes crash in the Mattermost Desktop App

Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desktop App which allows a malicious server or plugin to crash the desktop client via invoking {{window.close()}} in the renderer context, leading to a denial of service condition at the client level. Mattermost Advisory ID: MMSA-2026-00633

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2026-3471

Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2026-1046

Arbitrary application execution via unvalidated server-controlled URLs in Help menu

Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2026-1628

Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.

Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2025-13326

Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store

Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2025-13321

Mattermost Desktop App logging sensitive information and fails to clear data on server deletion

Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the users system to gain access to potentially sensitive information via reading the application logs.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2025-55035

Mattermost Desktop DoS when user has basic authentication server configured

Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their server which allows an attacker that provides a malicious server to the user to deny use of the Desktop App via having the user configure the malicious server and forcing a modal popup that cannot be closed.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2025-58084

Mattermost Desktop App crashes when clicking on malformed external URL

Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Desktop
CVE-2025-1398

macOS TCC Bypass via Code Injection

Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and Control (TCC) via code injection.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Apple Mattermost
Products
Macos Mattermost Mattermost Desktop
CVE-2023-5920

Lack Of Secure Keyboard Entry Protection in MacOS Desktop

Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Apple Mattermost
Products
Macos Mattermost Desktop
CVE-2023-2000

Unrestricted navigation due to unvalidated mattermost server redirection

Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Desktop
CVE-2024-37182

Lack of permissions prompting when opening external URLs

Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's system via custom URI schemes.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Desktop