Mattermost Desktop
Approved changes feed: RSS · Atom
cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Mattermost (ed0788ef-af60-58f1-b6aa-68289d9946dc) |
|---|---|
| Product | Mattermost Desktop (4a43fdaf-9c08-57c4-b718-be7fc51efdb0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/mattermost/desktop |
purl2cpe | 2026-06-01 10:18:19.798665 |
pkg:sourceforge/mattermost-desktop.mirror |
purl2cpe | 2026-06-01 10:18:19.798667 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-1628 |
vulnerable | 2026-06-08 07:49:09.065487 |
Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.
MEDIUM (4.6)
Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596
Published: 2026-03-02T13:24:21.391Z
Updated: 2026-03-02T14:58:30.546Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-1046 |
vulnerable | 2026-06-08 07:47:14.258104 |
Arbitrary application execution via unvalidated server-controlled URLs in Help menu
HIGH (7.6)
Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577
Published: 2026-02-16T12:10:38.668Z
Updated: 2026-02-17T17:05:58.569Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-58084 |
vulnerable | 2026-06-08 07:35:17.149949 |
Mattermost Desktop App crashes when clicking on malformed external URL
LOW (3.5)
Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.
Published: 2025-10-13T19:57:23.997Z
Updated: 2025-10-14T14:28:52.930Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55035 |
vulnerable | 2026-06-08 07:33:13.994998 |
Mattermost Desktop DoS when user has basic authentication server configured
MEDIUM (6.1)
Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their server which allows an attacker that provides a malicious server to the user to deny use of the Desktop App via having the user configure the malicious server and forcing a modal popup that cannot be closed.
Published: 2025-10-16T15:18:25.389Z
Updated: 2025-10-16T16:28:05.951Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1398 |
vulnerable | 2026-06-08 07:08:36.740684 |
macOS TCC Bypass via Code Injection
LOW (3.3)
Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and Control (TCC) via code injection.
Published: 2025-03-17T14:19:51.718Z
Updated: 2025-03-31T15:38:58.774Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13326 |
vulnerable | 2026-06-08 07:04:32.011796 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13321 |
vulnerable | 2026-06-08 07:04:32.000669 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45835 |
vulnerable | 2026-06-08 06:48:09.578122 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39772 |
vulnerable | 2026-06-08 06:41:51.553571 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39613 |
vulnerable | 2026-06-08 06:41:51.230244 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37182 |
vulnerable | 2026-06-08 06:39:46.834916 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-36287 |
vulnerable | 2026-06-08 06:39:44.161290 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5920 |
vulnerable | 2026-06-08 06:19:45.118098 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5876 |
vulnerable | 2026-06-08 06:19:45.008424 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5875 |
vulnerable | 2026-06-08 06:19:45.007938 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5339 |
vulnerable | 2026-06-08 06:19:43.240532 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2000 |
vulnerable | 2026-06-08 06:02:41.162885 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-14456 |
vulnerable | 2026-06-08 05:19:23.500301 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-14455 |
vulnerable | 2026-06-08 05:19:23.499863 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-14454 |
vulnerable | 2026-06-08 05:19:23.499452 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-20861 |
vulnerable | 2026-06-08 05:13:41.689948 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-20856 |
vulnerable | 2026-06-08 05:13:41.680654 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-21265 |
vulnerable | 2026-06-08 05:11:29.111014 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-11064 |
vulnerable | 2026-06-08 05:07:26.153632 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.