EUVD-2026-81678
GHSA-p8rx-2r7q-5wfv
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Network-positioned MITM downgrade fits adjacent AV:A and AC:H; authenticated user (PR:L) must click a link (UI:R); only content integrity is affected (I:L, C:N/A:N).
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Mattermost Advisory ID: MMSA-2026-00717
AnalysisAI
Mattermost Desktop App versions up to and including 6.2.2.0 fail to validate the URL scheme when deciding whether a link points to an internal server resource, so a network-positioned attacker who can intercept and downgrade the connection can make the client open a plugin popout window over an insecure (non-TLS) connection. Exploitation is narrow: it requires a man-in-the-middle position capable of forcing the scheme downgrade, an authenticated user of the affected client (PR:L per the CVSS vector), and that user clicking a crafted internal link (UI:R), which is why the vendor and independent scoring both land in the low range (vendor 2.6; independently assessed AV:A/AC:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a network-positioned (man-in-the-middle) attacker able to intercept and downgrade the connection between the Mattermost Desktop App (versions <=6.2.2.0) and its connected server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No fixed desktop client version is identified in the provided intelligence set, so the primary action is to treat 6.2.2.0 and earlier as vulnerable, monitor the Mattermost security updates page (https://mattermost.com/security-updates) for the MMSA-2026-00717 advisory and its patched desktop release, and roll the corrected client out as soon as it is published - desktop apps are typically auto-updating, so verify the deployed version rather than assuming the update landed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today