CVE-2026-6517
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded. This allows any user on a server without the image proxy enabled to intercept other users' credentials via embedding an image that routes to an external web server.
Risk Assessment
The risk associated with this vulnerability is the potential interception of user credentials, which could lead to unauthorized access to the organization's systems and data.
Recommendation
It is recommended to update the Mattermost Desktop App to the latest version that implements appropriate restrictions on NTLM credential forwarding and to enable image proxy on the server.
Other vulnerabilities in Mattermost Desktop App
See all- CVE-2026-75587Low
Mattermost Desktop App versions <=6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, allowing a local attacker with access to the report or log files to obtain the plaintext pre-auth secret via inspecting the Server Connectivity (Step-3) diagnostics output.
- CVE-2026-9602Medium
Mattermost Desktop App versions up to 6.2, 6.0.2, and 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App, allowing a malicious server owner to crash the Desktop App by sending a malformed method payload.
- CVE-2026-8075Medium
Mattermost Desktop App versions <=6.2, 5.5.13, and 6.0.2.0 fail to properly null check when validating headers, allowing any user to crash another channel member's Desktop App by posting a malicious link with an embedded image that misses one of those headers.
- CVE-2026-8683Medium
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to properly handle attempts to open extremely long URLs, allowing a malicious server owner to crash the application by including a script to call window.open on a very large URL.
Original NVD description (English source)
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that routes to an external web server. Mattermost Advisory ID: MMSA-2026-00651