Mattermost Desktop vulnerabilities

CVE-2018-21265 [MEDIUM] CWE-732 CVE-2018-21265: An issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin Policy An issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin Policy for setPermissionRequestHandler (e.g., video, audio, and notifications).

CVE-2023-5339 [MEDIUM] CWE-200 CVE-2023-5339: Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password entry being logged.

CVE-2026-4643 [LOW] CWE-754 CVE-2026-4643: Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from cl Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desktop App which allows a malicious server or plugin to crash the desktop client via invoking {{window.close()}} in the renderer context, leading to a denial of service condition at the client level.

CVE-2025-1398 [LOW] CWE-426 CVE-2025-1398: Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which al Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and Control (TCC) via code injection.

CVE-2025-13326 [LOW] CWE-693 CVE-2025-13326: Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.

CVE-2025-13321 [LOW] CWE-532 CVE-2025-13321: Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs a Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the users system to gain access to potentially sensitive information via reading the application logs.

CVE-2024-36287 [LOW] CWE-693 CVE-2024-36287: Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows fo Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.

CVE-2023-5920 [LOW] CWE-200 CVE-2023-5920: Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by ma Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input.