What is the CVSS score of CVE-2026-3471?

CVE-2026-3471 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Mattermost Desktop App CVE-2026-3471

Q: Which versions of Mattermost Desktop App are affected by CVE-2026-3471?

Mattermost Desktop App can be repeatedly crashed by malicious server administrators through JavaScript URL injection in pop-up windows.

EUVD-2026-30757 MEDIUM

Improper Authorization in Handler for Custom URL Scheme (CWE-939)

2026-05-18 Mattermost

GHSA-fhqj-97rr-gvhp

Mattermost Denial Of Service

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 09:32 vuln.today

DescriptionCVE.org

Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618

AnalysisAI

Mattermost Desktop App can be repeatedly crashed by malicious server administrators through JavaScript URL injection in pop-up windows. Attackers controlling a Mattermost server can force connected desktop clients to become unusable by exploiting improper URL validation, requiring user interaction (connecting to the malicious server). No public exploit code identified at time of analysis, though the attack method is trivial to implement given the disclosed details.

Technical ContextAI

The vulnerability stems from CWE-939 (Improper Authorization in Handler for Custom URL Scheme), where the desktop application fails to validate URLs passed to window.open() calls. The Electron-based Mattermost Desktop App allows JavaScript execution within pop-up window contexts without proper sanitization of javascript: protocol URIs. When a server sends instructions to open a window with a javascript: URL, the application executes the code rather than blocking the dangerous protocol. This affects the desktop client's BrowserWindow configuration and URL handling logic, specifically the lack of proper protocol allowlisting for new window creation. The affected CPE indicates the core Mattermost application framework, though this vulnerability is specific to the desktop client implementation across Windows, macOS, and Linux platforms.

RemediationAI

Upgrade Mattermost Desktop App to version 6.2 or later, which implements proper URL protocol validation for pop-up windows (specific patched version inferred from vulnerable version ceiling of 6.1; verify exact release number at https://mattermost.com/security-updates). Until patching is complete, implement compensating controls: restrict desktop client connections to only trusted, organizationally-controlled Mattermost servers through endpoint configuration policies or network firewall rules blocking external Mattermost server connections (trade-off: eliminates remote collaboration capabilities with external partners). Organizations can also enforce browser-based client usage instead of desktop app for connections to untrusted servers (trade-off: reduced offline functionality and desktop integration features). For high-security environments, disable JavaScript execution in desktop client if application settings permit, though this may break legitimate server functionality and is not a recommended long-term solution.