Mattermost Desktop vulnerabilities
34 vulnerabilities
Known vulnerabilities in Mattermost Desktop, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-21265mattermostmattermost_desktop
EPSS score0.77%
An issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin Policy for setPermissionRequestHandler (e.g., video, audio, and notifications).CVE-2016-11064mattermostmattermost_desktopEPSS score1.29%
An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.CVE-2025-13326mattermostmattermost+1EPSS score0.11%
Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.CVE-2025-13321mattermostmattermost+2EPSS score0.12%
Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the users system to gain access to potentially sensitive information via reading the application logs.CVE-2025-1398mattermostmattermost+2EPSS score0.17%
Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and Control (TCC) via code injection.CVE-2025-55035mattermostmattermost+1EPSS score0.32%
Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their server which allows an attacker that provides a malicious server to the user to deny use of the Desktop App via having the user configure the malicious server and forcing a modal popup that cannot be closed.CVE-2025-58084mattermostmattermost+1EPSS score0.30%
Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.CVE-2020-14454mattermostmattermost_desktopEPSS score0.75%
An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandled, aka MMSA-2020-0008.CVE-2020-14455mattermostmattermost_desktopEPSS score1.17%
An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007.CVE-2020-14456mattermostmattermost_desktopEPSS score0.43%
An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-2020-0006.CVE-2024-36287ubuntutcc+3EPSS score0.19%
Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.CVE-2024-39613mattermostmattermost+2EPSS score0.30%
Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machine.CVE-2024-39772mattermostmattermost+2EPSS score0.31%
Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs.CVE-2024-37182mattermostmattermost+2EPSS score0.30%
Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's system via custom URI schemes.CVE-2024-45835mattermostmattermost+2EPSS score0.21%
Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access.CVE-2019-20856mattermostmattermost_desktopEPSS score1.44%
An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.CVE-2019-20861mattermostmattermost_desktopEPSS score1.66%
An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link.CVE-2026-1628mattermostmattermost+1EPSS score0.14%
Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596CVE-2026-1046mattermostmattermost+1EPSS score0.26%
Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577CVE-2026-9602mattermostmattermost+1EPSS score0.42%
Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash the Mattermost Desktop App via changing the payload of a method to a malformed one. Mattermost Advisory ID: MMSA-2026-00678