← Back

CVE-2026-1046

nvd nist
Published: Feb 16, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577

Affected (2)

Mattermost
1 product
Mattermost Desktop
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost
Mattermost Desktop
From 5.13.2 to 5.13.3
Mattermost Desktop
From 6.0.0 to 6.0.3

Related CWEs

CWE-939
Improper Authorization in Handler for Custom URL Scheme
The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

References (1)

Source: responsibledisclosure@mattermost.com
Vendor Advisory

Timeline

No history available yet.