Executive brief
Mattermost is a collaboration and messaging platform used by organizations for internal communication. A security flaw in the Mattermost Desktop App allows an attacker to steal a user's Windows login credentials (NTLM hashes) by embedding a malicious image in a chat message. This occurs because the application incorrectly sends sensitive authentication data to external servers, potentially allowing an attacker to gain unauthorized access to the victim's corporate account or network.
Technical details
The Mattermost Desktop App (versions <=6.1 and 5.5.13.0) contains an insufficient credential protection vulnerability (CWE-522). The application fails to properly restrict the list of trusted domains allowed to receive NTLM authentication hashes. On Mattermost servers where the image proxy is disabled, a remote attacker with low privileges can embed a specially crafted image link in a message. When a victim views the message, the Desktop App attempts to fetch the image and automatically forwards the user's NTLM credentials to the attacker-controlled external web server. This requires the attacker to have an account on the same Mattermost server as the victim.
Affected products
- Mattermost Desktop App <=6.1, 5.5.13.0
Timeline
- 2026-06-15: disclosed: CVE published and advisory issued by Mattermost.