Mattermost Desktop App CVE-2026-3471

Requires victim to connect Mattermost Desktop App to an attacker-controlled or compromised Mattermost server. The attacker must have server administrator privileges or ability to inject JavaScript execution commands through the server's messaging or plugin system. Users must be running vulnerable desktop application versions (6.1 or earlier) and actively connected to the malicious server when the window.open() call is triggered. Exploitation does not require any special desktop application configuration beyond default settings - the vulnerability exists in standard installations. The user interaction requirement (UI:R in CVSS) is connecting to and maintaining a session with the malicious server, not clicking a specific link or prompt.

Real-world risk is moderate and contextual. CVSS 6.5 (AV:N/AC:L/PR:N/UI:R) indicates network-reachable attack with low complexity but required user interaction. The EPSS data is not provided, limiting quantitative exploitation probability assessment. Not listed in CISA KEV, indicating no confirmed widespread active exploitation. The attack requires users to connect their desktop client to a malicious or compromised Mattermost server, significantly limiting the attack surface compared to truly unauthenticated remote exploits. Impact is strictly availability (A:H) with no confidentiality or integrity compromise, reducing business risk compared to data-exfiltration vulnerabilities. The trivial nature of the exploit code (single JavaScript function call) means any server administrator can weaponize this, but the prerequisite of controlling a server that targets trust creates natural friction. Organizations using self-hosted Mattermost with trusted administrators face minimal risk; those connecting to external or multi-tenant servers should prioritize patching. The repeated crash capability could enable denial-of-service against specific users or teams, disrupting business communications.

An attacker compromises a Mattermost server or operates a malicious server, then social engineers targets to connect their desktop clients to it. Once connected, the attacker injects JavaScript calling window.open('javascript:alert()') through server-side channels, immediately crashing the victim's desktop application. The attacker can automate repeated crash triggers, rendering the application unusable and forcing victims to reinstall or reconfigure, disrupting team communications and productivity.