Mattermost Desktop App CVE-2026-12284

Exploitation requires the Mattermost Desktop App (<=6.2.2.0) to be simultaneously connected to at least two servers, one of which is malicious, compromised, or otherwise grants an attacker script access to a connected server view. That attacker-controlled view must then send a desktopAPI.leaveCall IPC message; because the leaveCall handler does not validate the IPC sender's origin (CWE-346), the message can target and disconnect an active call belonging to a *different* connected server. Limiting factors: the victim must be running a multi-server configuration, must have an active call in progress on the second server at the time, and the attacker must already control one connected server or its scriptable view - so this does not apply to single-server deployments or clients with no concurrent call. Impact is confined to dropping the call; there is no data access or code execution.

This is a genuinely low-priority issue, and the raw CVSS 3.8 (Low) is a faithful representation of real-world risk. The vendor vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L confirms the only impact is a low availability hit (A:L) with no confidentiality or integrity consequence - this is a nuisance-grade denial of a single feature (an active call), not code execution or data exposure. AC:H reflects meaningful preconditions: the victim must have the desktop client simultaneously connected to a malicious/compromised server AND have an active call running against a *different* connected server. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation is theoretical at time of analysis. The input Tags label this 'Information Disclosure,' which directly contradicts the CVSS vector (C:N) - the actual effect is availability (A:L), so treat the 'Information Disclosure' framing as an input-data error, not a real confidentiality risk. Bottom line: low-severity, low-probability, requiring a multi-server threat model that most single-server deployments never hit.

A Mattermost desktop user connects their client to two servers, one of which is attacker-controlled (or has been compromised, or exposes script access to a connected server view). The malicious server view issues a forged desktopAPI.leaveCall IPC message that the leaveCall handler processes without validating the sender's origin, causing the client to disconnect the user's active call on the *other*, legitimate server. No public proof-of-concept was identified, and the impact is limited to dropping an in-progress call.