Executive brief
Mattermost is a collaboration platform used for team communication. A vulnerability in the Mattermost Desktop application allows a malicious server owner to repeatedly crash a user's application by triggering invalid pop-up windows. This results in a denial-of-service for the user, disrupting their ability to communicate and collaborate.
Technical details
The Mattermost Desktop App contains a vulnerability classified under CWE-939 (Improper Authorization in Handler for Custom URL Scheme). The application fails to properly validate or restrict URLs when opening new windows via the window.open() method. A malicious server owner can exploit this by calling window.open('javascript:alert()'), which causes the desktop client to crash. This is a remote attack requiring user interaction (connecting to the malicious server) and results in a high impact on application availability.
Affected products
- Mattermost Desktop App <=6.1, 6.0.1, 5.4.13.0
Timeline
- 2026-05-18: disclosed
- 2026-05-18: advisory