← Back

CVE-2026-1628

nvd nist
Published: Mar 2, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.6
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Exploitability: 2.1 / Impact: 2.5
Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596

Affected (1)

Mattermost
1 product
Mattermost Desktop
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost Desktop
Before 5.13.4

Related CWEs

CWE-829
Inclusion of Functionality from Untrusted Control Sphere
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

References (1)

Source: responsibledisclosure@mattermost.com
Vendor Advisory

Timeline

No history available yet.