CVE-2025-13326

The Mattermost Desktop App in versions <=6.2 6.2.2.0 fails to validate the URL scheme when checking whether a target URL is internal to the connected server. A network-positioned attacker can load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Advisory ID: MMSA-2026-00717.

The Mattermost Desktop App in versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler, allowing a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Advisory ID: MMSA-2026-00699.

Mattermost Desktop App versions <=6.2 6.2.2.0 did not sufficiently restrict server-rendered content from accessing local or private network resources. The issue was reported under the Mattermost responsible disclosure policy (MMSA-2026-00698).

Mattermost Desktop App versions <=6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, allowing a local attacker with access to the report or log files to obtain the plaintext pre-auth secret via inspecting the Server Connectivity (Step-3) diagnostics output.

Mattermost Desktop App versions up to 6.2, 6.0.2, and 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App, allowing a malicious server owner to crash the Desktop App by sending a malformed method payload.

Mattermost Desktop App versions <=6.2, 5.5.13, and 6.0.2.0 fail to properly null check when validating headers, allowing any user to crash another channel member's Desktop App by posting a malicious link with an embedded image that misses one of those headers.

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to properly handle attempts to open extremely long URLs, allowing a malicious server owner to crash the application by including a script to call window.open on a very large URL.

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded. This allows any user on a server without the image proxy enabled to intercept other users' credentials via embedding an image that routes to an external web server.

Mattermost Desktop App versions earlier than 6.0.0 fail to sanitize sensitive information from logs and clear data on server deletion. An attacker with access to the user's system can gain access to potentially sensitive information by reading application logs.