Skip to content
OpenAdvisories
Medium WID-SEC-2026-1565 3 CVEs

Mattermost Desktop: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published May 17, 2026 · Updated Jun 15, 2026 · Revision 3 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Mattermost Desktop ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 3

  • Medium 6.5
    CVE-2026-3471

    Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

    Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:ale…

    Mattermost Mattermost
  • Medium 6.5
    CVE-2026-8683

    Overly long URLs crash the Mattermost Desktop App

    Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a script to call window.open on a very large U…

    Mattermost Mattermost
  • Low 3.5
    CVE-2026-4643

    Calling window.close() from server-side content causes crash in the Mattermost Desktop App

    Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desktop App which allows a malicious server or plugin to crash the desktop client via invoking {{window.…

    Mattermost Mattermost

Revision history

  1. #3

    Referenz(en) aufgenommen: CVE-2026-8683, EUVD-2026-36732

  2. #2

    CVE ergänzt

  3. #1

    Initiale Fassung

References