# CVE-2026-12284: Mattermost Desktop App IPC validation bypass in leaveCall handler

Source: https://junglewise.ai/threats/cve-2026-12284-mattermost-desktop-app-ipc-validation-bypass-in-leavecall-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-12284 · Severity: low · CVSS 3.7 · Published 2026-09-17

Mattermost Desktop App (through version 6.2.2.0) fails to properly validate the source of inter-process communication (IPC) messages in its call-handling code. This allows a malicious or compromised Mattermost server, or an attacker with script access to a connected server, to forcibly disconnect active calls on other connected servers. While the direct impact is limited to call disruption, this represents a cross-server privilege escalation that undermines the isolation between separate server connections.

Technologies: [Mattermost Desktop App](https://junglewise.ai/threats/technologies/desktop-app). Vendors: [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-12284 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12284 being exploited in the wild.

**How severe is CVE-2026-12284?** Low severity, with a CVSS score of 3.7, published 17 September 2026.

**Which products and versions are affected?** Mattermost Desktop App <=6.2.2.0.

**Is there a fix for CVE-2026-12284?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12284 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-12284?** Check whether you run Mattermost Desktop App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an IPC sender validation bypass in the leaveCall handler of Mattermost Desktop App. When processing the desktopAPI.leaveCall IPC message, the application fails to verify that the message originates from the intended server connection. An attacker controlling or with script injection access to one Mattermost server instance can craft IPC messages to terminate active calls on a different connected server. The attack vector is network-based and requires the victim to have multiple Mattermost servers connected in the Desktop App. No special authentication or user interaction is required beyond the existing connection. A fix is available in versions after 6.2.2.0.

## Affected products

- Mattermost Desktop App <=6.2.2.0

## Timeline

- 2026-09-17: disclosed: CVE-2026-12284 published

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost Desktop App URL scheme validation bypass](https://junglewise.ai/threats/cve-2026-75588-mattermost-desktop-app-url-scheme-validation-bypass)
- [Mattermost Desktop App content restriction bypass](https://junglewise.ai/threats/cve-2026-75025-mattermost-desktop-app-content-restriction-bypass)
- [Mattermost Desktop App denial of service via malformed payload](https://junglewise.ai/threats/cve-2026-9602-mattermost-desktop-app-denial-of-service-via-malformed-payload)
- [Mattermost Desktop App denial of service via malicious image link](https://junglewise.ai/threats/cve-2026-8075-mattermost-desktop-app-denial-of-service-via-malicious-image-link)
- [Mattermost Desktop App denial of service via long URLs](https://junglewise.ai/threats/cve-2026-8683-mattermost-desktop-app-denial-of-service-via-long-urls)