URL Scheme Validation Issue in Mattermost Desktop App
CVE-2026-75588

2.6LOW

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
17 September 2026

What is CVE-2026-75588?

The Mattermost Desktop App exhibits a vulnerability where versions 6.2 and 6.2.2.0 fail to properly validate the URL scheme. This oversight allows an attacker positioned on the same network to exploit the connection by loading a plugin popout window using a downgraded, insecure URL scheme. This could potentially expose users to unauthorized actions and data interception while interacting with the affected application. For more details, refer to the vendor advisory at Mattermost.

Affected Version(s)

Mattermost 0 <= 6.2.2

Mattermost 6.3.0

Mattermost 6.2.3.0

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
2.6
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Juho Forsén
.