Skip to content
OpenAdvisories
Medium WID-SEC-2026-2876 3 CVEs

Mattermost Desktop: Mehrere Schwachstellen

Published Aug 17, 2026 · Updated Sep 17, 2026 · Revision 2 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Mattermost Desktop ausnutzen, um Informationen offenzulegen oder um nicht näher spezifizierte Auswirkungen zu verursachen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 3

  • Low 3.8
    CVE-2026-12284

    Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

    Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging …

    Mattermost Mattermost
  • Low 3.6
    CVE-2026-75587

    Plaintext pre-auth secret exposure via Desktop App diagnostics report

    Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for…

    Mattermost Mattermost
  • Low 2.6
    CVE-2026-75588

    Mattermost Desktop App plugin popout scheme validation bypass

    Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a l…

    Mattermost Mattermost

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References