CVE-2025-55035: Mattermost Desktop DoS when user has basic authentication server configured

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-16 · updated 2026-10-19
Weakness: CWE-754

Description

Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their server which allows an attacker that provides a malicious server to the user to deny use of the Desktop App via having the user configure the malicious server and forcing a modal popup that cannot be closed.

Affected products

Mattermost Desktop: before 5.13.1.0 — fixed in 5.13.1.0

How to fix

Upgrade to a fixed version: Mattermost Desktop 5.13.1.0. Check the vendor advisory for mitigations.

References

https://mattermost.com/security-updates

Get alerted when CVE-2025-55035 or the next vulnerability affects your stack