What is the CVSS score of CVE-2026-8683?

CVE-2026-8683 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Mattermost Desktop App CVE-2026-8683

EUVD-2026-36732 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-15 Mattermost

GHSA-pf78-3frq-v82v

Mattermost Denial Of Service

6.5

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Delivery via attacker-controlled network server; victim must connect actively (UI:R); crash-only impact (A:H); no client-side privilege required (PR:N); no C or I impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 16:31 vuln.today

DescriptionCVE.org

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a script to call window.open on a very large URL. Mattermost Advisory ID: MMSA-2026-00652

AnalysisAI

Denial of service in Mattermost Desktop App (versions ≤6.1 and ≤5.5.13.0) allows a malicious Mattermost server owner to crash client applications by injecting a script that calls window.open() with an excessively large URL, exploiting a missing resource limit on URL length processing. Exploitation requires user interaction - the victim must actively connect their Desktop App to an attacker-controlled server - and impact is strictly limited to application availability with no confidentiality or integrity exposure. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the Mattermost Desktop App, built on the Electron framework, does not enforce an upper bound on URL length before passing it to the underlying window.open() call. When a URL exceeds OS or Electron runtime resource limits, the resulting unhandled allocation failure terminates the application process. The affected software surface is the client-server trust boundary in Mattermost's architecture, where a connected server can deliver JavaScript into the desktop client context. The CPE string cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* covers the Mattermost desktop client across both the v6.x and v5.x release branches. The advisory identifier MMSA-2026-00652 is Mattermost's own internal tracking reference, confirming first-party acknowledgment of the issue.

RemediationAI

Upgrade the Mattermost Desktop App to a version above 6.1 on the v6.x branch or above 5.5.13.0 on the v5.x branch per the Mattermost security advisory at https://mattermost.com/security-updates (MMSA-2026-00652). Note that exact patched release version numbers beyond the stated vulnerable upper bounds were not independently confirmed in the available data - consult the advisory page directly for the specific fixed release. As a compensating control pending upgrade, enforce endpoint policy or firewall rules restricting Mattermost Desktop App connections to only internally managed, trusted server instances; this removes the malicious-server-owner threat actor from the risk model entirely. Organizations operating Mattermost in a closed enterprise environment where all server connections are pre-approved face negligible residual risk even prior to patching.