Executive brief
Mattermost Desktop App contains a flaw where it does not properly validate URL schemes when determining if a URL belongs to the connected server. An attacker on the network can exploit this to redirect users to malicious plugin popout windows delivered over an insecure connection, potentially enabling credential theft or malware distribution disguised as legitimate server content.
Technical details
The vulnerability exists in the URL validation logic of Mattermost Desktop App, where the application fails to properly validate URL schemes when checking whether a target URL is internal to the connected server. An attacker positioned on the network can craft a malicious link using a downgraded URL scheme (e.g., HTTP instead of HTTPS) to bypass the internal URL check and load a plugin popout window over an insecure connection. This requires user interaction (clicking a link) and network-level attack positioning. The issue allows an attacker to serve content that appears to come from the trusted server, enabling phishing or malware delivery attacks. A fix is available in versions after 6.2.2.0.
Affected products
- Mattermost Desktop App 6.2.2.0 and earlier
Timeline
- 2026-09-17: disclosed