CVE-2025-13326: Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store

Severity: low (CVSS 3.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-17 · updated 2026-10-13
Weakness: CWE-693

Description

Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.

Affected products

Mattermost Desktop: before 6.0.0 — fixed in 6.0.0

How to fix

Upgrade to a fixed version: Mattermost Desktop 6.0.0. Check the vendor advisory for mitigations.

References

https://mattermost.com/security-updates

Get alerted when CVE-2025-13326 or the next vulnerability affects your stack