Mattermost Mattermost_desktop
28 CVEs affecting Mattermost Mattermost_desktop. Latest disclosed: 2026-06-15. Critical: 2, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-11064 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection. |
CVE-2019-20856 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection. |
CVE-2019-20861 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link. |
CVE-2026-1046 | High | 7.6 | 2026-02-16 | Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on… |
CVE-2020-14456 | High | 7.3 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-202… |
CVE-2026-8683 | Medium | 6.5 | 2026-06-15 | Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a maliciou… |
CVE-2026-3471 | Medium | 6.5 | 2026-05-18 | Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows… |
CVE-2020-14455 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007. |
CVE-2026-6517 | Medium | 6.3 | 2026-06-15 | Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop… |
CVE-2025-55035 | Medium | 6.1 | 2025-10-16 | Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication fro… |
CVE-2020-14454 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandle… |
CVE-2023-2000 | Medium | 5.4 | 2023-05-02 | Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website |
CVE-2024-39613 | Medium | 5.3 | 2024-09-16 | Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an… |
CVE-2018-21265 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin Policy for setPermissionRequestHandler (e.g., video, audio, and n… |
CVE-2024-37182 | Medium | 4.7 | 2024-06-14 | Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim ove… |
CVE-2023-5339 | Medium | 4.7 | 2023-10-17 | Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password ent… |
CVE-2026-1628 | Medium | 4.6 | 2026-03-02 | Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious s… |
CVE-2025-13326 | Low | 3.9 | 2025-12-17 | Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attack… |
CVE-2024-36287 | Low | 3.8 | 2024-06-14 | Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS. |
CVE-2024-39772 | Low | 3.7 | 2024-09-16 | Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots vi… |