Read the docs

Mattermost

Records671All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical26CVSS 9.0–10.0
CVSS high130CVSS 7.0–8.9

Exploited now

Mattermost records in CISA KEV

No Mattermost vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mattermost Server 506 records MEDIUM Mattermost 77 records MEDIUM Mattermost Desktop 34 records MEDIUM Mattermost Mobile 21 records LOW Confluence 14 records LOW Focalboard 2 records LOW Legal Hold 2 records LOW Mattermost Boards 2 records LOW

Records

34 records in Mattermost Desktop · all components

TI-2024-26542 CVE-2024-39613 · GHSA-wj4j-qc2m-fgh7

RCE in desktop app in Windows by local attacker

Priority LOW 34

Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to ca…

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00299 Published 2024-09-16 Fixed in 5.9.0 CWE-427
TI-2026-05712 CVE-2026-6517 · GHSA-2wmq-3m94-g4jr

Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

Priority LOW 33

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image prox…

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00187 Published 2026-06-15 Fixed in 6.2.0, 5.13.6.0 CWE-522
TI-2026-00781 CVE-2026-1046 · GHSA-gjx5-j34g-5g5p

Arbitrary application execution via unvalidated server-controlled URLs in Help menu

Priority LOW 33

Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in th…

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00259 Published 2026-02-16 Fixed in 6.1.0, 6.0.3.0 +1 CWE-939
TI-2026-07113 CVE-2026-8075 · GHSA-rm64-886x-w6qc

Posting a malicious markdown image crashes the Mattermost Desktop App

Priority LOW 29

Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a ma…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0042 Published 2026-07-17 Fixed in 6.3.0, 5.13.6.0 +1 CWE-754
TI-2025-35925 CVE-2025-58084 · GHSA-c8m2-cx6j-jf7p

Mattermost Desktop App crashes when clicking on malformed external URL

Priority LOW 29

Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00303 Published 2025-10-13 Fixed in 5.13.1 CWE-1287
TI-2026-07630 CVE-2026-8683 · GHSA-pf78-3frq-v82v

Overly long URLs crash the Mattermost Desktop App

Priority LOW 28

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a scrip…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00199 Published 2026-06-15 Fixed in 6.2.0, 5.13.6.0 CWE-770
TI-2026-02990 CVE-2026-3471 · GHSA-fhqj-97rr-gvhp

Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

Priority LOW 28

Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application vi…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00184 Published 2026-05-18 Fixed in 6.2.0, 6.1.1.0 +1 CWE-939
TI-2024-30794 CVE-2024-45835 · GHSA-xgq9-7gw6-jr5r

Insufficient Electron Fuses Configuration

Priority LOW 28

Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00205 Published 2024-09-16 Fixed in 5.9.0 CWE-693
TI-2025-34727 CVE-2025-55035 · GHSA-3359-25fv-h37v

Mattermost Desktop DoS when user has basic authentication server configured

Priority LOW 27

Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their server which allows an attacker that provid…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00315 Published 2025-10-16 Fixed in 5.13.1.0 CWE-754
TI-2024-24708 CVE-2024-37182 · GHSA-hvxg-77mg-vrvp

Lack of permissions prompting when opening external URLs

Priority LOW 27

Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's syst…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.003 Published 2024-06-14 Fixed in 5.8.0 CWE-693
TI-2026-08433 CVE-2026-9602 · GHSA-82vr-gjvh-q9r8

Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods

Priority LOW 26

Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash the Mattermost Desktop App via changing th…

CVSS 3.1MEDIUM 5.7 Network Low privileges No interaction EPSS 0.0042 Published 2026-07-17 Fixed in 6.3.0, 6.2.1.0 +1 CWE-400
TI-2023-05411 CVE-2023-5876 · GHSA-p8hg-mm67-hmp8

Regex DoS from a malicious server enrolled in Desktop

Priority LOW 25

Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00596 Published 2023-11-02 Fixed in 5.5.1 CWE-400
TI-2024-26690 CVE-2024-39772 · GHSA-5777-rcjj-9p22

Silent Desktop Screenshot Capture

Priority LOW 24

Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00312 Published 2024-09-16 Fixed in 5.9.0 CWE-284
TI-2023-05410 CVE-2023-5875 · GHSA-2vpw-vxmx-p733

Lack of Hardening against media exploitation from a remote origin

Priority LOW 24

Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious mattermost server

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00392 Published 2023-11-02 Fixed in 5.5.1 CWE-693
TI-2026-52718 CVE-2026-75025 · GHSA-jcpq-22g2-pfpw

Mattermost Desktop local network access from server-rendered content

Priority LOW 21

Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00155 Published 2026-09-16 Fixed in 6.3.0, 6.2.3.0 CWE-346
TI-2026-01314 CVE-2026-1628 · GHSA-4q28-37qp-xh4g

Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.

Priority LOW 20

Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted ser…

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00162 Published 2026-03-02 Fixed in 5.13.4.0 CWE-829
Load more
Open these records in search →