CVE-2026-1628

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1628", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2026-01-29T15:14:51.993Z", "datePublished": "2026-03-02T13:24:21.391Z", "dateUpdated": "2026-03-02T14:58:30.546Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "5.13.3", "status": "affected", "version": "0", "versionType": "semver"}, {"version": "5.13.4.0", "status": "unaffected"}]}], "credits": [{"lang": "en", "type": "finder", "value": "N/A"}], "descriptions": [{"lang": "en", "value": "Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596"}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "baseSeverity": "MEDIUM", "baseScore": 4.6}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "cweId": "CWE-829"}]}], "references": [{"url": "https://mattermost.com/security-updates", "name": "MMSA-2026-00596", "tags": ["vendor-advisory"]}], "solutions": [{"value": "Update Mattermost Desktop App to versions 5.13.4.0 or higher.", "lang": "en"}], "source": {"advisory": "MMSA-2026-00596", "defect": ["https://mattermost.atlassian.net/browse/MM-67374"], "discovery": "EXTERNAL"}, "title": "Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.", "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2026-03-02T13:24:21.391Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T14:57:20.504558Z", "id": "CVE-2026-1628", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T14:58:30.546Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1628", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T14:57:20.504558Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T14:58:22.983Z"}}], "cna": {"title": "Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-67374"], "advisory": "MMSA-2026-00596", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "N/A"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.13.3"}, {"status": "unaffected", "version": "5.13.4.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost Desktop App to versions 5.13.4.0 or higher."}], "references": [{"url": "https://mattermost.com/security-updates", "name": "MMSA-2026-00596", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2026-03-02T13:24:21.391Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1628", "state": "PUBLISHED", "dateUpdated": "2026-03-02T14:58:30.546Z", "dateReserved": "2026-01-29T15:14:51.993Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2026-03-02T13:24:21.391Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "5.13.3", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "5.13.4.0"}]}], "source": "responsibledisclosure@mattermost.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*", "matchCriteriaId": "17854B0E-22CE-4E16-A346-75A6E24BD9E3", "versionEndExcluding": "5.13.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596"}, {"lang": "es", "value": "Las versiones &lt;=5.13.3 de la aplicaci\u00f3n de escritorio de Mattermost no adjuntan oyentes que restringen la navegaci\u00f3n a sitios externos dentro de la aplicaci\u00f3n Mattermost, lo que permite a un servidor malicioso exponer la funcionalidad de script de precarga a servidores no confiables al hacer que un usuario abra un enlace externo en su servidor Mattermost. ID de Aviso de Mattermost: MMSA-2026-00596"}], "id": "CVE-2026-1628", "lastModified": "2026-06-17T10:16:13.057", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1628", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T14:57:20.504558Z", "version": "2.0.3"}}]}, "published": "2026-03-02T14:16:23.223", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.13.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "5.13.4.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Mattermost", "source": "cna", "vendor": "Mattermost"}, "product": "mattermost", "vendor": "mattermost"}], "analysis": {"en": {"generated_at": "2026-04-16T14:34:02.735935+00:00", "value": {"mitigation_remediation": ["Update Mattermost Desktop App to version 5.13.4 or later.", "Configure the desktop client or its settings to block navigation to external sites, thereby preventing the loading of external preload scripts.", "Apply network or endpoint filtering to restrict access to untrusted domains from the desktop application."], "summary": {"action": "Patch", "impact": "Execution of malicious scripts via preload"}, "threat_synthesis": {"affected_systems": "Affected by Mattermost. The Mattermost Desktop App versions 5.13.3 and earlier are vulnerable. The application runs on all platforms supported by the desktop client. No other vendors or products are listed. Updates or patches are not available for older or unsupported releases.", "description_and_impact": "The Mattermost Desktop App up to version 5.13.3 does not enforce navigation restrictions for external links. When a user opens a link that points to an untrusted site, the app allows the site to supply a preload script, which runs with the full privileges of the desktop environment. This flaw could enable an attacker to execute arbitrary code in the user\u2019s local machine, leading to disclosure of sensitive data, credential theft, or further compromise of the system. The weakness corresponds to improper restriction of native functionality (CWE\u2011829).", "risk_and_exploitability": "The CVSS base score of 4.6 indicates moderate risk, and the EPSS score below 1\u202f% suggests that the vulnerability is unlikely to be exploited broadly at this time. The flaw is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog, which further reflects a low exploitation probability. Attackers would need a legitimate Mattermost account and a user click on a malicious link to launch the preload script, so the vector relies on social engineering or compromised content. The impact is limited to the device executing the desktop client."}}}}, "created": "2026-03-03T08:45:11.876438+00:00", "updated": "2026-04-16T14:45:25.930414+00:00", "vendors": ["mattermost", "mattermost$PRODUCT$mattermost"]}