CVE-2026-8683
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to properly handle attempts to open extremely long URLs, allowing a malicious server owner to crash the application by including a script to call window.open on a very large URL.
Risk Assessment
Malicious URLs can lead to application crashes, affecting service availability for users. This could be exploited for denial-of-service attacks.
Recommendation
It is recommended to update the Mattermost Desktop App to the latest version to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Mattermost Desktop App
See all- CVE-2026-75587Low
Mattermost Desktop App versions <=6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, allowing a local attacker with access to the report or log files to obtain the plaintext pre-auth secret via inspecting the Server Connectivity (Step-3) diagnostics output.
- CVE-2026-9602Medium
Mattermost Desktop App versions up to 6.2, 6.0.2, and 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App, allowing a malicious server owner to crash the Desktop App by sending a malformed method payload.
- CVE-2026-8075Medium
Mattermost Desktop App versions <=6.2, 5.5.13, and 6.0.2.0 fail to properly null check when validating headers, allowing any user to crash another channel member's Desktop App by posting a malicious link with an embedded image that misses one of those headers.
- CVE-2026-6517Medium
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded. This allows any user on a server without the image proxy enabled to intercept other users' credentials via embedding an image that routes to an external web server.
Original NVD description (English source)
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a script to call window.open on a very large URL. Mattermost Advisory ID: MMSA-2026-00652