Executive brief
Mattermost Desktop App (through version 6.2.2.0) fails to properly validate the source of inter-process communication (IPC) messages in its call-handling code. This allows a malicious or compromised Mattermost server, or an attacker with script access to a connected server, to forcibly disconnect active calls on other connected servers. While the direct impact is limited to call disruption, this represents a cross-server privilege escalation that undermines the isolation between separate server connections.
Technical details
The vulnerability is an IPC sender validation bypass in the leaveCall handler of Mattermost Desktop App. When processing the desktopAPI.leaveCall IPC message, the application fails to verify that the message originates from the intended server connection. An attacker controlling or with script injection access to one Mattermost server instance can craft IPC messages to terminate active calls on a different connected server. The attack vector is network-based and requires the victim to have multiple Mattermost servers connected in the Desktop App. No special authentication or user interaction is required beyond the existing connection. A fix is available in versions after 6.2.2.0.
Affected products
- Mattermost Desktop App <=6.2.2.0
Timeline
- 2026-09-17: disclosed: CVE-2026-12284 published