CVE-2026-75587

Mattermost Desktop App versions <=6.2 6.2.2.0 did not sufficiently restrict server-rendered content from accessing local or private network resources. The issue was reported under the Mattermost responsible disclosure policy (MMSA-2026-00698).

The Mattermost Desktop App in versions <=6.2 6.2.2.0 fails to validate the URL scheme when checking whether a target URL is internal to the connected server. A network-positioned attacker can load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Advisory ID: MMSA-2026-00717.

The Mattermost Desktop App in versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler, allowing a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Advisory ID: MMSA-2026-00699.

Mattermost Desktop App versions up to 6.2, 6.0.2, and 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App, allowing a malicious server owner to crash the Desktop App by sending a malformed method payload.

Mattermost Desktop App versions <=6.2, 5.5.13, and 6.0.2.0 fail to properly null check when validating headers, allowing any user to crash another channel member's Desktop App by posting a malicious link with an embedded image that misses one of those headers.

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to properly handle attempts to open extremely long URLs, allowing a malicious server owner to crash the application by including a script to call window.open on a very large URL.

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded. This allows any user on a server without the image proxy enabled to intercept other users' credentials via embedding an image that routes to an external web server.