CVE-2025-13321
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Mattermost Desktop App versions earlier than 6.0.0 fail to sanitize sensitive information from logs and clear data on server deletion. An attacker with access to the user's system can gain access to potentially sensitive information by reading application logs.
Risk Assessment
The risk is the leakage of sensitive data, such as tokens, passwords, or message content, to third parties with physical or remote access to the user's system.
Recommendation
Update Mattermost Desktop App to version 6.0.0 or later, which includes fixes for log sanitization and data clearing on server deletion.
Other vulnerabilities in Mattermost Desktop App
See all- CVE-2026-75588Low
The Mattermost Desktop App in versions <=6.2 6.2.2.0 fails to validate the URL scheme when checking whether a target URL is internal to the connected server. A network-positioned attacker can load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Advisory ID: MMSA-2026-00717.
- CVE-2026-12284Low
The Mattermost Desktop App in versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler, allowing a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Advisory ID: MMSA-2026-00699.
- CVE-2026-75025Medium
Mattermost Desktop App versions <=6.2 6.2.2.0 did not sufficiently restrict server-rendered content from accessing local or private network resources. The issue was reported under the Mattermost responsible disclosure policy (MMSA-2026-00698).
- CVE-2026-75587Low
Mattermost Desktop App versions <=6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, allowing a local attacker with access to the report or log files to obtain the plaintext pre-auth secret via inspecting the Server Connectivity (Step-3) diagnostics output.
- CVE-2026-9602Medium
Mattermost Desktop App versions up to 6.2, 6.0.2, and 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App, allowing a malicious server owner to crash the Desktop App by sending a malformed method payload.
- CVE-2026-8075Medium
Mattermost Desktop App versions <=6.2, 5.5.13, and 6.0.2.0 fail to properly null check when validating headers, allowing any user to crash another channel member's Desktop App by posting a malicious link with an embedded image that misses one of those headers.
- CVE-2026-8683Medium
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to properly handle attempts to open extremely long URLs, allowing a malicious server owner to crash the application by including a script to call window.open on a very large URL.
- CVE-2026-6517Medium
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded. This allows any user on a server without the image proxy enabled to intercept other users' credentials via embedding an image that routes to an external web server.
- CVE-2025-13326Low
Mattermost Desktop App versions earlier than 6.0.0 fail to enable Hardened Runtime when packaged for Mac App Store. This allows an attacker to inherit TCC permissions by copying the binary to a tmp folder.
Original NVD description (English source)
Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the users system to gain access to potentially sensitive information via reading the application logs.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS