An issue was discovered in Mattermost Desktop App before 3.4.0

An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS

An issue was discovered in Mattermost Desktop App before 4.2.2

Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the…

Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

An issue was discovered in Mattermost Desktop App before 4.4.0

Posting a malicious markdown image crashes the Mattermost Desktop App

Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods

Overly long URLs crash the Mattermost Desktop App

Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

Arbitrary application execution via unvalidated server-controlled URLs in Help menu

Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash…

Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via…

An issue was discovered in Mattermost Desktop App before 4.4.0

Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their…

Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to…

An issue was discovered in Mattermost Desktop App before 4.4.0

Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password entry being logged

Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website

Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs

Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service

Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious mattermost server

An issue was discovered in Mattermost Desktop App before 4.0.0

Mattermost Desktop local network access from server-rendered content

Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.

Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC…

Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

Calling window.close() from server-side content causes crash in the Mattermost Desktop App

Plaintext pre-auth secret exposure via Desktop App diagnostics report

Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the…

Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and…

Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS

Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input

Mattermost Desktop App plugin popout scheme validation bypass