Skip to content
OpenAdvisories
High · 7.6 CVE-2026-1046 EUVD-2026-6090GHSA-gjx5-j34g-5g5p

Arbitrary application execution via unvalidated server-controlled URLs in Help menu

Published Feb 16, 2026 · Updated Feb 17, 2026 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost

Description

Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ 6.2.0, ≤ 5.2.13 6.1.0

References