Quick answers
- Is CVE-2026-75588 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-75588 being exploited in the wild.
- How severe is CVE-2026-75588?
- Low severity, with a CVSS score of 2.6, published 17 September 2026.
- Which products and versions are affected?
- Mattermost Desktop App 6.2.2.0 and earlier.
- Is there a fix for CVE-2026-75588?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-75588 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-75588?
- Check whether you run Mattermost Desktop App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the URL validation logic of Mattermost Desktop App, where the application fails to properly validate URL schemes when checking whether a target URL is internal to the connected server. An attacker positioned on the network can craft a malicious link using a downgraded URL scheme (e.g., HTTP instead of HTTPS) to bypass the internal URL check and load a plugin popout window over an insecure connection. This requires user interaction (clicking a link) and network-level attack positioning. The issue allows an attacker to serve content that appears to come from the trusted server, enabling phishing or malware delivery attacks. A fix is available in versions after 6.2.2.0.
Affected products
- Mattermost Desktop App 6.2.2.0 and earlier
Timeline
- 2026-09-17: disclosed