# CVE-2026-75025: Mattermost Desktop App content restriction bypass

Source: https://junglewise.ai/threats/cve-2026-75025-mattermost-desktop-app-content-restriction-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-75025 · Severity: medium · CVSS 4.7 · Published 2026-09-16

Mattermost Desktop App is a communication and collaboration tool used by teams to share messages and files. In versions 6.2 and earlier, the application failed to properly isolate server-rendered content, allowing it to access local network resources and potentially exposing sensitive information on users' computers. This could be exploited by a malicious Mattermost server to access files or network services without the user's knowledge.

Technologies: [Mattermost Desktop App](https://junglewise.ai/threats/technologies/desktop-app). Vendors: [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-75025 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75025 being exploited in the wild.

**How severe is CVE-2026-75025?** Medium severity, with a CVSS score of 4.7, published 16 September 2026.

**Which products and versions are affected?** Mattermost Desktop App <=6.2, fixed in 6.2.2.0.

**Is there a fix for CVE-2026-75025?** A patch was published on 2026-09-16: Fixed in version 6.2.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75025 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75025?** Check whether you run Mattermost Desktop App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a content restriction bypass in Mattermost Desktop App versions 6.2 and earlier. The application did not sufficiently restrict server-rendered content from accessing local or private network resources, violating security sandboxing principles. An attacker controlling or compromising a Mattermost server could craft malicious content that, when rendered by the desktop client, accesses local files, internal network services, or performs unauthorized operations on the user's machine. Network-accessible attack vector, no authentication required from the attacker perspective (the user must be connected to a compromised server). The issue was fixed in version 6.2.2.0.

## Affected products

- Mattermost Desktop App <=6.2, fixed in 6.2.2.0

## Timeline

- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in version 6.2.2.0

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost Desktop App URL scheme validation bypass](https://junglewise.ai/threats/cve-2026-75588-mattermost-desktop-app-url-scheme-validation-bypass)
- [Mattermost Desktop App IPC validation bypass in leaveCall handler](https://junglewise.ai/threats/cve-2026-12284-mattermost-desktop-app-ipc-validation-bypass-in-leavecall-handler)
- [Mattermost Desktop App denial of service via malformed payload](https://junglewise.ai/threats/cve-2026-9602-mattermost-desktop-app-denial-of-service-via-malformed-payload)
- [Mattermost Desktop App denial of service via malicious image link](https://junglewise.ai/threats/cve-2026-8075-mattermost-desktop-app-denial-of-service-via-malicious-image-link)
- [Mattermost Desktop App denial of service via long URLs](https://junglewise.ai/threats/cve-2026-8683-mattermost-desktop-app-denial-of-service-via-long-urls)