What is the CVSS score of CVE-2026-1046?

CVE-2026-1046 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-1046?

Within 24 hours: inventory all Mattermost Desktop App deployments and identify affected versions (≤6.0, 6.2.0, 5.2.13.0); communicate risk to users and restrict access if possible. Within 7 days: disable the Help menu feature via server configuration, or implement network controls to restrict users from connecting to untrusted Mattermost servers. Within 30 days: monitor vendor for patch availability and test in pre-production environment; upgrade all affected instances to patched versions upon release; conduct audit of Mattermost server configurations to detect any suspicious help link modifications.

Mattermost CVE-2026-1046

MEDIUM

Improper Authorization in Handler for Custom URL Scheme (CWE-939)

2026-02-16 responsibledisclosure@mattermost.com

Information Disclosure Mattermost Mattermost Desktop

6.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker compromises Mattermost server
Exploit

Crafts malicious help link in Help menu
Execution

User clicks help menu item
Impact

Arbitrary executable launches on system

Vulnerability Assessment

Weakness	CWE CWE-939 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V4 - API and Web Service Improper authorization in handler
Exploitation Conditions	Mattermost Desktop App versions <=6.0, 6.2.0, or 5.2.13.0 with help link validation disabled. Requires authenticated user account on compromised Mattermost server instance and user interaction clicking Help menu items.
Impact	CVSS 7.6 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: Required.
Exploit ScenarioDerived	An attacker could exploit this vulnerability to compromise the affected system.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Arbitrary code execution in Mattermost Desktop App through version 6.2.0 results from insufficient validation of help menu links, enabling a malicious server administrator to execute arbitrary executables on affected users' systems when they click specially crafted help items. This vulnerability affects multiple versions including 5.2.13.0 and 6.0, requiring user interaction and authenticated server access to exploit. No patch is currently available for this HIGH severity vulnerability.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:54 CVSS 7.6

Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577 [CVSS 7.6 HIGH]

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Know when Mattermost gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Oct 15, 2026 - 13:37 NVD

HIGH MEDIUM

CVSS changed

Oct 15, 2026 - 13:37 NVD

7.6 (HIGH) 6.5 (MEDIUM)

CVE Published

Feb 16, 2026 - 13:16 nvd

HIGH 7.6

DescriptionNVD

Executive ViewAI

Why It Matters

Mattermost Desktop App users running versions 6.0, 6.2.0, or 5.2.13.0 are at risk of arbitrary code execution if they click malicious help menu links served by a compromised or malicious Mattermost server. This vulnerability could allow attackers to gain system-level access to affected user endpoints, potentially compromising sensitive data and enabling lateral movement within the organization.

Business Impact: High

Compensating Controls

Disable or hide the Help menu in Mattermost Desktop App configuration settings; restrict user access to Mattermost servers only from trusted internal infrastructure; implement application whitelisting to prevent arbitrary executable execution; require user authentication review before clicking external help links; monitor endpoint execution logs for suspicious processes spawned from Mattermost processes; consider restricting Mattermost Desktop App usage until patch is available, or mandate browser-based access instead.

Threat Intelligence Overview

EPSS Score

0.0%

Top 90% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.