Mattermost Desktop (Mattermost) - vulnerabilities (CVEs)
34 CVEs, 0 in the last 30 days, 296 known versions, newest CVE from 2026-09-17. Vendor: Mattermost.
CVEs of Mattermost Desktop
- CVE-2026-12284 - CVSS 3.8 (low), 2026-09-17: Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost…
- CVE-2026-75588 - CVSS 2.6 (low), 2026-09-17: Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which…
- CVE-2026-75025 - CVSS 4.7 (medium), 2026-09-16: Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing…
- CVE-2026-75587 - CVSS 3.6 (low), 2026-08-17: Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with…
- CVE-2026-8075 - CVSS 6.5 (medium), 2026-07-17: Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user…
- CVE-2026-9602 - CVSS 6.5 (medium), 2026-07-17: Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious…
- CVE-2026-8683 - CVSS 6.5 (medium), 2026-06-15: Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a…
- CVE-2026-6517 - CVSS 7.7 (high), 2026-06-15: Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost…
- CVE-2026-4643 - CVSS 3.5 (low), 2026-05-18: Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost…
- CVE-2026-3471 - CVSS 6.5 (medium), 2026-05-18: Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows…
- CVE-2026-1628 - CVSS 4.6 (medium), 2026-03-02: Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious…
- CVE-2026-1046 - CVSS 7.6 (high), 2026-02-16: Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables…
- CVE-2025-13326 - CVSS 3.9 (low), 2025-12-17: Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an…
- CVE-2025-13321 - CVSS 3.3 (low), 2025-12-17: Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker…
- CVE-2025-55035 - CVSS 6.1 (medium), 2025-10-16: Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication…
- CVE-2025-58084 - CVSS 6.5 (medium), 2025-10-13: Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has…
- CVE-2025-1398 - CVSS 3.3 (low), 2025-03-17: Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass…
- CVE-2024-45835 - CVSS 6.5 (medium), 2024-09-16: Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other…
- CVE-2024-39772 - CVSS 5.3 (medium), 2024-09-16: Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots…
- CVE-2024-39613 - CVSS 7.8 (high), 2024-09-16: Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an…
- CVE-2024-37182 - CVSS 6.1 (medium), 2024-06-14: Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim…
- CVE-2024-36287 - CVSS 3.8 (low), 2024-06-14: Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.
- CVE-2023-5876 - CVSS 5.3 (medium), 2023-11-02: Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of…
- CVE-2023-5875 - CVSS 5.3 (medium), 2023-11-02: Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious…
- CVE-2023-5920 - CVSS 3.3 (low), 2023-11-02: Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard…
- CVE-2023-5339 - CVSS 5.5 (medium), 2023-10-17: Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password…
- CVE-2023-2000 - CVSS 5.4 (medium), 2023-05-02: Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website
- CVE-2016-11064 - CVSS 9.8 (critical), 2020-06-19: An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
- CVE-2018-21265 - CVSS 5.3 (medium), 2020-06-19: An issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin Policy for setPermissionRequestHandler (e.g., video, audio, and…
- CVE-2019-20861 - CVSS 8.8 (high), 2020-06-19: An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link.
- CVE-2019-20856 - CVSS 9.8 (critical), 2020-06-19: An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.
- CVE-2020-14455 - CVSS 6.5 (medium), 2020-06-19: An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007.
- CVE-2020-14454 - CVSS 6.1 (medium), 2020-06-19: An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is…
- CVE-2020-14456 - CVSS 7.3 (high), 2020-06-19: An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka…
