CVE-2025-13326

Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.

Score

CVSS 3.1 3.9 Low

Status

Analyzed - responsibledisclosure@mattermost.com

Published

2025-12-17

Last modified

2026-10-13

Weaknesses

CWE-693

Affected products

• Mattermost (Mattermost)
• Mattermost Desktop (Mattermost)

References

• https://mattermost.com/security-updates