CVE-2026-3471

Published: May 18, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618

Affected (3)

Products: Mattermost: Mattermost Desktop

1 product

Mattermost Desktop

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mattermost Mattermost Desktop	Up to 5.4.13.0
Mattermost Mattermost Desktop	From 6.0.0 to 6.0.1
Mattermost Mattermost Desktop	From 6.1.0 to 6.2.0

Related CWEs

Improper Authorization in Handler for Custom URL Scheme

The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

References (1)

https://mattermost.com/security-updates

Source: responsibledisclosure@mattermost.com

Vendor Advisory

Timeline

No history available yet.