Mattermost Desktop CVE-2025-13326

Exploitation requires the victim to be running the Mac App Store-packaged build of Mattermost Desktop (versions earlier than 6.0.0) on macOS - the build in which Apple's Hardened Runtime was not enabled. The attacker must already have local access to the host with the ability to run code or place/launch files (to copy the Mattermost binary into a tmp folder and execute it), and the target must have previously granted Mattermost TCC privacy permissions that are worth inheriting. Limiting factors: the vector is entirely local (no network exploitation), it depends on the specific Mac App Store packaging rather than default direct-download builds, it is scoped to macOS only, and it provides only low-impact access to already-granted TCC resources rather than full system compromise.

This is a low-priority, low-real-world-risk issue despite being a legitimate security weakness. All signals align downward: the CVSS 3.1 base score is 3.9 (LOW) with a vector (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) that requires local access, some privileges, and user interaction, yielding only LOW confidentiality and integrity impact and no availability impact. EPSS corroborates this at 0.11% (1st percentile), indicating a very low probability of exploitation in the wild. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation or weaponization. No SSVC decision data was provided in the input. The one nuance worth flagging: this is a protection-mechanism failure (CWE-693 - the Hardened Runtime was simply not enabled for the Mac App Store build) rather than a directly exploitable memory or logic flaw, so exploitation depends on an attacker already having local code-execution or app-planting capability on the macOS host. The signals are internally consistent - there is no CVSS-versus-EPSS or KEV conflict here - and all point to a defense-in-depth hardening gap rather than an urgent remotely exploitable vulnerability.

An attacker with local access to a macOS machine (e.g., a malicious app or a process running as the user) copies the Mac App Store-packaged Mattermost Desktop binary into a writable tmp folder and executes it from there. Because the Hardened Runtime was not enabled, the relocated binary inherits the TCC (Transparency, Consent, and Control) privacy permissions originally granted to Mattermost, letting the attacker access protected resources the user had approved. No public exploit code has been identified for this specific issue.