CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

PT-2026-94361

Mattermost Desktop App versions =6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server or a user with script access to a connected server view to disconnect an active call belonging to a different connected server via the...

PT-2026-94365

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

CVE-2026-12284: Origin Validation Error

Mattermost Desktop App versions =6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server or a user with script access to a connected server view to disconnect an active call belonging to a different connected server via the...

CVE-2026-75588: Improper Validation of Specified Type of Input

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

CVE-2026-75025

Mattermost Desktop App versions =6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy...

EUVD-2026-80939

Mattermost Desktop App versions =6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy...

CVE-2026-75025 Mattermost Desktop local network access from server-rendered content

Mattermost Desktop App versions =6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy...

CVE-2026-75025

Mattermost Desktop App versions up to and including 6.2 are affected by a restriction flaw: server-rendered content was not sufficiently restricted from accessing local or private network resources from the desktop client. The issue was rated CVSS 3.1: 4.7 (MEDIUM) with a changed scope and low co...

CVE-2026-75025 Mattermost Desktop local network access from server-rendered content

Mattermost Desktop App versions =6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy...

PT-2026-93898

Mattermost Desktop App versions =6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy...

CVE-2026-75025: Origin Validation Error

Mattermost Desktop App versions =6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy...

EUVD-2026-78160

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret...

CVE-2026-91181

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret...

CVE-2026-91181

CVE-2026-91181 affects Mattermost versions 11.9.0 and earlier, 11.8.4 and earlier, 11.7.7 and earlier, and 10.11.22 and earlier. The data retention teams endpoint (GET /api/v4/data_retention/policies/{policy_id}/teams) fails to sanitize Team objects, allowing an authenticated user with only the r...

CVE-2026-91181 Data Retention Teams Endpoint Leaks Private Team Invite ID

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret...

CVE-2026-91181 Data Retention Teams Endpoint Leaks Private Team Invite ID

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret...

CVE-2026-12985

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...

CVE-2026-86348

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

CVE-2026-86349

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.8, 10.11.x = 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service CPU resource exhaustion via a crafted post containing deeply nested...