Executive brief
Mattermost is a collaboration platform used for team communication. A vulnerability in the Mattermost Desktop App allows a malicious server or plugin to force the application to close unexpectedly. This results in a denial-of-service for the user, disrupting their ability to communicate and collaborate until the application is restarted.
Technical details
The Mattermost Desktop App fails to properly sanitize or restrict server-rendered content from interacting with the underlying application view. Specifically, the application does not prevent the renderer context from invoking the window.close() method. An attacker controlling a malicious server or a malicious plugin can trigger this method to force the desktop client to close. This vulnerability is classified as an improper check for unusual or exceptional conditions (CWE-754). Exploitation requires a network-connected attacker with low privileges and some user interaction, resulting in a client-side denial of service.
Affected products
- Mattermost Desktop App <=6.1, 6.0.1, 5.4.13.0
Timeline
- 2026-05-18: disclosed: NVD publication date
- 2026-05-18: advisory: Mattermost Advisory MMSA-2026-00633 published