# CVE-2026-75588: Mattermost Desktop App URL scheme validation bypass

Source: https://junglewise.ai/threats/cve-2026-75588-mattermost-desktop-app-url-scheme-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-75588 · Severity: low · CVSS 2.6 · Published 2026-09-17

Mattermost Desktop App contains a flaw where it does not properly validate URL schemes when determining if a URL belongs to the connected server. An attacker on the network can exploit this to redirect users to malicious plugin popout windows delivered over an insecure connection, potentially enabling credential theft or malware distribution disguised as legitimate server content.

Technologies: [Mattermost Desktop App](https://junglewise.ai/threats/technologies/desktop-app). Vendors: [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-75588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75588 being exploited in the wild.

**How severe is CVE-2026-75588?** Low severity, with a CVSS score of 2.6, published 17 September 2026.

**Which products and versions are affected?** Mattermost Desktop App 6.2.2.0 and earlier.

**Is there a fix for CVE-2026-75588?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75588 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75588?** Check whether you run Mattermost Desktop App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the URL validation logic of Mattermost Desktop App, where the application fails to properly validate URL schemes when checking whether a target URL is internal to the connected server. An attacker positioned on the network can craft a malicious link using a downgraded URL scheme (e.g., HTTP instead of HTTPS) to bypass the internal URL check and load a plugin popout window over an insecure connection. This requires user interaction (clicking a link) and network-level attack positioning. The issue allows an attacker to serve content that appears to come from the trusted server, enabling phishing or malware delivery attacks. A fix is available in versions after 6.2.2.0.

## Affected products

- Mattermost Desktop App 6.2.2.0 and earlier

## Timeline

- 2026-09-17: disclosed

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost Desktop App IPC validation bypass in leaveCall handler](https://junglewise.ai/threats/cve-2026-12284-mattermost-desktop-app-ipc-validation-bypass-in-leavecall-handler)
- [Mattermost Desktop App content restriction bypass](https://junglewise.ai/threats/cve-2026-75025-mattermost-desktop-app-content-restriction-bypass)
- [Mattermost Desktop App denial of service via malformed payload](https://junglewise.ai/threats/cve-2026-9602-mattermost-desktop-app-denial-of-service-via-malformed-payload)
- [Mattermost Desktop App denial of service via malicious image link](https://junglewise.ai/threats/cve-2026-8075-mattermost-desktop-app-denial-of-service-via-malicious-image-link)
- [Mattermost Desktop App denial of service via long URLs](https://junglewise.ai/threats/cve-2026-8683-mattermost-desktop-app-denial-of-service-via-long-urls)