CVE-2026-1046

Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mattermost:mattermost_desktop::::::::
	cpe:2.3:a:mattermost:mattermost_desktop::::::::

History

23 Mar 2026, 17:27

Type	Values Removed	Values Added
First Time		Mattermost Mattermost mattermost Desktop
References	~~() https://mattermost.com/security-updates -~~	() https://mattermost.com/security-updates - Vendor Advisory
CPE		cpe:2.3:a:mattermost:mattermost_desktop::::::::

18 Feb 2026, 17:52

Type	Values Removed	Values Added
Summary		(es) Las versiones <=6.0 6.2.0 5.2.13.0 de la Aplicación de escritorio Mattermost no validan los enlaces de ayuda, lo que permite que un servidor Mattermost malicioso ejecute ejecutables arbitrarios en el sistema de un usuario al hacer clic el usuario en ciertos elementos del menú de Ayuda. ID de aviso de Mattermost: MMSA-2026-00577

16 Feb 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-16 13:16

Updated : 2026-03-23 17:27

NVD link : CVE-2026-1046

Mitre link : CVE-2026-1046

CVE.ORG link : CVE-2026-1046

JSON object : View

Products Affected

mattermost

mattermost_desktop

CWE

CWE-939

Improper Authorization in Handler for Custom URL Scheme

{"id": "CVE-2026-1046", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2026-02-16T13:16:00.793", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-939"}]}], "descriptions": [{"lang": "en", "value": "Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user\u2019s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577"}, {"lang": "es", "value": "Las versiones <=6.0 6.2.0 5.2.13.0 de la Aplicaci\u00f3n de escritorio Mattermost no validan los enlaces de ayuda, lo que permite que un servidor Mattermost malicioso ejecute ejecutables arbitrarios en el sistema de un usuario al hacer clic el usuario en ciertos elementos del men\u00fa de Ayuda. ID de aviso de Mattermost: MMSA-2026-00577"}], "lastModified": "2026-03-23T17:27:17.083", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC95A24C-5114-4A60-A792-8785203293C2", "versionEndExcluding": "5.13.3", "versionStartIncluding": "5.13.2"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A567559-94D1-4F5E-9D34-1E8A441B6657", "versionEndExcluding": "6.0.3", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}