Mattermost Desktop App vulnerabilities

The Mattermost Desktop App in versions <=6.2 6.2.2.0 fails to validate the URL scheme when checking whether a target URL is internal to the connected server. A network-positioned attacker can load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Advisory ID: MMSA-2026-00717.

The Mattermost Desktop App in versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler, allowing a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Advisory ID: MMSA-2026-00699.

Mattermost Desktop App versions <=6.2 6.2.2.0 did not sufficiently restrict server-rendered content from accessing local or private network resources. The issue was reported under the Mattermost responsible disclosure policy (MMSA-2026-00698).

Mattermost Desktop App versions <=6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, allowing a local attacker with access to the report or log files to obtain the plaintext pre-auth secret via inspecting the Server Connectivity (Step-3) diagnostics output.

Mattermost Desktop App versions up to 6.2, 6.0.2, and 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App, allowing a malicious server owner to crash the Desktop App by sending a malformed method payload.

Mattermost Desktop App versions <=6.2, 5.5.13, and 6.0.2.0 fail to properly null check when validating headers, allowing any user to crash another channel member's Desktop App by posting a malicious link with an embedded image that misses one of those headers.

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to properly handle attempts to open extremely long URLs, allowing a malicious server owner to crash the application by including a script to call window.open on a very large URL.

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded. This allows any user on a server without the image proxy enabled to intercept other users' credentials via embedding an image that routes to an external web server.

Mattermost Desktop App versions earlier than 6.0.0 fail to enable Hardened Runtime when packaged for Mac App Store. This allows an attacker to inherit TCC permissions by copying the binary to a tmp folder.

Mattermost Desktop App versions earlier than 6.0.0 fail to sanitize sensitive information from logs and clear data on server deletion. An attacker with access to the user's system can gain access to potentially sensitive information by reading application logs.

Mattermost Desktop App versions <=5.13.0 fail to manage modals, preventing a user with a server that uses basic authentication from accessing their server. An attacker providing a malicious server can deny use of the Desktop App by having the user configure the malicious server and forcing a modal popup that cannot be closed.

Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers. An attacker on a server the user has configured can send a malformed URL, causing the user's application to crash.