# Mattermost Desktop App vulnerabilities Source: https://junglewise.ai/threats/technologies/desktop-app Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/desktop-app.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in Mattermost Desktop App: 0 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-75588, was published on 17 September 2026. Nothing in the last four weeks, down from 3 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 3 - All time: 14 (0 critical, 0 exploited in the wild) ## About Mattermost Desktop App A native desktop application for the Mattermost open-source collaboration platform. ## Latest Mattermost Desktop App vulnerabilities - [CVE-2026-75588: Mattermost Desktop App URL scheme validation bypass](https://junglewise.ai/threats/cve-2026-75588-mattermost-desktop-app-url-scheme-validation-bypass) (low, CVSS 2.6, published 17 Sep 2026) - [CVE-2026-12284: Mattermost Desktop App IPC validation bypass in leaveCall handler](https://junglewise.ai/threats/cve-2026-12284-mattermost-desktop-app-ipc-validation-bypass-in-leavecall-handler) (low, CVSS 3.7, published 17 Sep 2026) - [CVE-2026-75025: Mattermost Desktop App content restriction bypass](https://junglewise.ai/threats/cve-2026-75025-mattermost-desktop-app-content-restriction-bypass) (medium, CVSS 4.7, published 16 Sep 2026) - [CVE-2026-9602: Mattermost Desktop App denial of service via malformed payload](https://junglewise.ai/threats/cve-2026-9602-mattermost-desktop-app-denial-of-service-via-malformed-payload) (medium, CVSS 6.5, published 17 Jul 2026) - [CVE-2026-8075: Mattermost Desktop App denial of service via malicious image link](https://junglewise.ai/threats/cve-2026-8075-mattermost-desktop-app-denial-of-service-via-malicious-image-link) (medium, CVSS 6.5, published 17 Jul 2026) - [CVE-2026-8683: Mattermost Desktop App denial of service via long URLs](https://junglewise.ai/threats/cve-2026-8683-mattermost-desktop-app-denial-of-service-via-long-urls) (medium, CVSS 6.5, published 15 Jun 2026) - [CVE-2026-6517: Mattermost Desktop App NTLM credential leakage via embedded images](https://junglewise.ai/threats/cve-2026-6517-mattermost-desktop-app-ntlm-credential-leakage-via-embedded-images) (medium, CVSS 6.3, published 15 Jun 2026) - [CVE-2026-4643: Mattermost Desktop App denial of service via window.close](https://junglewise.ai/threats/cve-2026-4643-mattermost-desktop-app-denial-of-service-via-window-close) (low, CVSS 3.5, published 18 May 2026) - [CVE-2026-3471: Mattermost Desktop App denial of service via invalid pop-up URL](https://junglewise.ai/threats/cve-2026-3471-mattermost-desktop-app-denial-of-service-via-invalid-pop-up-url) (medium, CVSS 6.5, published 18 May 2026) - [CVE-2025-13321: Mattermost Desktop App information disclosure in logs](https://junglewise.ai/threats/cve-2025-13321-mattermost-desktop-app-information-disclosure-in-logs) (low, CVSS 3.3, published 17 Dec 2025) - [CVE-2025-1398: Mattermost Desktop App TCC bypass via code injection](https://junglewise.ai/threats/cve-2025-1398-mattermost-desktop-app-tcc-bypass-via-code-injection) (low, CVSS 3.1, published 17 Mar 2025) - [CVE-2024-39772: Mattermost Desktop App insufficient screen capture protection](https://junglewise.ai/threats/cve-2024-39772-mattermost-desktop-app-insufficient-screen-capture-protection) (low, CVSS 3.1, published 16 Sep 2024) - [CVE-2024-39613: Mattermost Desktop App uncontrolled search path vulnerability](https://junglewise.ai/threats/cve-2024-39613-mattermost-desktop-app-uncontrolled-search-path-vulnerability) (low, CVSS 3.1, published 16 Sep 2024) - [CVE-2024-36287: Mattermost Desktop App TCC bypass on macOS](https://junglewise.ai/threats/cve-2024-36287-mattermost-desktop-app-tcc-bypass-on-macos) (low, CVSS 3.1, published 14 Jun 2024) ## Most severe Mattermost Desktop App vulnerabilities - [CVE-2026-9602: Mattermost Desktop App denial of service via malformed payload](https://junglewise.ai/threats/cve-2026-9602-mattermost-desktop-app-denial-of-service-via-malformed-payload) (medium, CVSS 6.5, published 17 Jul 2026) - [CVE-2026-8075: Mattermost Desktop App denial of service via malicious image link](https://junglewise.ai/threats/cve-2026-8075-mattermost-desktop-app-denial-of-service-via-malicious-image-link) (medium, CVSS 6.5, published 17 Jul 2026) - [CVE-2026-8683: Mattermost Desktop App denial of service via long URLs](https://junglewise.ai/threats/cve-2026-8683-mattermost-desktop-app-denial-of-service-via-long-urls) (medium, CVSS 6.5, published 15 Jun 2026) - [CVE-2026-3471: Mattermost Desktop App denial of service via invalid pop-up URL](https://junglewise.ai/threats/cve-2026-3471-mattermost-desktop-app-denial-of-service-via-invalid-pop-up-url) (medium, CVSS 6.5, published 18 May 2026) - [CVE-2026-6517: Mattermost Desktop App NTLM credential leakage via embedded images](https://junglewise.ai/threats/cve-2026-6517-mattermost-desktop-app-ntlm-credential-leakage-via-embedded-images) (medium, CVSS 6.3, published 15 Jun 2026) - [CVE-2026-75025: Mattermost Desktop App content restriction bypass](https://junglewise.ai/threats/cve-2026-75025-mattermost-desktop-app-content-restriction-bypass) (medium, CVSS 4.7, published 16 Sep 2026) - [CVE-2026-12284: Mattermost Desktop App IPC validation bypass in leaveCall handler](https://junglewise.ai/threats/cve-2026-12284-mattermost-desktop-app-ipc-validation-bypass-in-leavecall-handler) (low, CVSS 3.7, published 17 Sep 2026) - [CVE-2026-4643: Mattermost Desktop App denial of service via window.close](https://junglewise.ai/threats/cve-2026-4643-mattermost-desktop-app-denial-of-service-via-window-close) (low, CVSS 3.5, published 18 May 2026) - [CVE-2025-13321: Mattermost Desktop App information disclosure in logs](https://junglewise.ai/threats/cve-2025-13321-mattermost-desktop-app-information-disclosure-in-logs) (low, CVSS 3.3, published 17 Dec 2025) - [CVE-2024-39772: Mattermost Desktop App insufficient screen capture protection](https://junglewise.ai/threats/cve-2024-39772-mattermost-desktop-app-insufficient-screen-capture-protection) (low, CVSS 3.1, published 16 Sep 2024) ## Vulnerabilities per week Nothing in the last four weeks, down from 3 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 3 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Mattermost technologies - [Mattermost Server](https://junglewise.ai/threats/technologies/server-public): 111 vulnerabilities - [Mattermost](https://junglewise.ai/threats/technologies/mattermost): 9 vulnerabilities - [Mattermost Plugins](https://junglewise.ai/threats/technologies/mattermost-plugins): 5 vulnerabilities - [Mattermost GitHub Plugin for Mattermost](https://junglewise.ai/threats/technologies/github-plugin): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Mattermost Desktop App vulnerabilities", https://junglewise.ai/threats/technologies/desktop-app, 12 November 2026.