What’s Vulnerable › Products
Mattermost Desktop vulnerabilities
34 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.
Check whether your Mattermost Desktop version is affected
Latest Mattermost Desktop vulnerabilities
- CVE-2026-75588 — Mattermost Desktop App plugin popout scheme validation bypass (CVSS 2.6)
- CVE-2026-12284 — Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler (CVSS 3.7)
- CVE-2026-75025 — Mattermost Desktop local network access from server-rendered content (CVSS 4.7)
- CVE-2026-75587 — Plaintext pre-auth secret exposure via Desktop App diagnostics report (CVSS 3.3)
- CVE-2026-9602 — Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods (CVSS 6.5)
- CVE-2026-8075 — Posting a malicious markdown image crashes the Mattermost Desktop App (CVSS 6.5)
- CVE-2026-8683 — Overly long URLs crash the Mattermost Desktop App (CVSS 6.5)
- CVE-2026-6517 — Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed (CVSS 7.7)
- CVE-2026-4643 — Calling window.close() from server-side content causes crash in the Mattermost Desktop App (CVSS 3.5)
- CVE-2026-3471 — Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App (CVSS 6.5)
- CVE-2026-1628 — Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites. (CVSS 4.6)
- CVE-2026-1046 — Arbitrary application execution via unvalidated server-controlled URLs in Help menu (CVSS 6.5)
- CVE-2025-13326 — Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store (CVSS 3.9)
- CVE-2025-13321 — Mattermost Desktop App logging sensitive information and fails to clear data on server deletion (CVSS 3.3)
- CVE-2025-55035 — Mattermost Desktop DoS when user has basic authentication server configured (CVSS 6.1)
- CVE-2025-58084 — Mattermost Desktop App crashes when clicking on malformed external URL (CVSS 6.5)
- CVE-2025-1398 — macOS TCC Bypass via Code Injection (CVSS 3.3)
- CVE-2024-45835 — Insufficient Electron Fuses Configuration (CVSS 6.5)
- CVE-2024-39772 — Silent Desktop Screenshot Capture (CVSS 5.3)
- CVE-2024-39613 — RCE in desktop app in Windows by local attacker (CVSS 7.8)
- CVE-2024-37182 — Lack of permissions prompting when opening external URLs (CVSS 6.1)
- CVE-2024-36287 — Bypass of TCC restrictions on macOS (CVSS 3.3)
- CVE-2023-5920 — Lack Of Secure Keyboard Entry Protection in MacOS Desktop (CVSS 3.3)
- CVE-2023-5876 — Regex DoS from a malicious server enrolled in Desktop (CVSS 5.3)
- CVE-2023-5875 — Lack of Hardening against media exploitation from a remote origin (CVSS 5.3)