Skip to main content

Mattermost Desktop CVE-2026-9602

| EUVDEUVD-2026-45156 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-07-17 Mattermost GHSA-82vr-gjvh-q9r8
Denial Of Service Mattermost
6.5
CVSS 3.1 · Vendor: Mattermost
Share

Severity by source

Vendor (Mattermost) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.9 MEDIUM

Attacker must fully own a Mattermost server instance, which is an administrative/high-privilege position, warranting PR:H over the vendor's PR:L; no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
CVSS changed
Jul 17, 2026 - 11:22 NVD
5.7 (MEDIUM) 6.5 (MEDIUM)
Analysis Generated
Jul 17, 2026 - 10:47 vuln.today

DescriptionCVE.org

Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash the Mattermost Desktop App via changing the payload of a method to a malformed one. Mattermost Advisory ID: MMSA-2026-00678

AnalysisAI

Mattermost Desktop App across the 5.x and 6.x release branches can be crashed by a malicious server operator through unvalidated inter-process payloads sent from the Mattermost Web App to the Desktop App. The root cause is the absence of payload validation in the Web-to-Desktop communication channel, enabling a server owner to send a malformed method payload that causes uncontrolled processing and application termination on the connected client. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Attacker gains control of a Mattermost server
Delivery
Victim Desktop App connects to attacker server
Exploit
Server delivers malformed method payload via Web-to-Desktop IPC
Execution
Desktop App processes payload without validation
Impact
Uncontrolled processing causes application crash (DoS)
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The victim must be running an affected version of Mattermost Desktop App (spanning the 5.6.x and 6.x branches) AND must actively connect to a Mattermost server that is owned or controlled by the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-reported CVSS 3.1 score of 5.7 and vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H classifies this as Medium severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who operates or has compromised a Mattermost server modifies server-side code to inject a malformed method payload into the Web App-to-Desktop App communication channel when a victim client connects. The Desktop App, lacking payload validation, processes the malformed structure and crashes, repeatedly denying the user access to the application for as long as they attempt to reconnect to the malicious server. …
Remediation Upgrade the Mattermost Desktop App to versions beyond the last-affected releases in each branch (6.x, 6.0.x, and 5.6.x) per the vendor advisory at https://mattermost.com/security-updates; exact patched version numbers per branch should be confirmed there as they are not independently verifiable from the current advisory data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mattermost

View all
CVE-2026-48801 HIGH POC
8.7 Jun 26

Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
CVE-2022-4044 MEDIUM POC
6.5 Nov 23

A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
CVE-2022-3257 MEDIUM POC
6.5 Sep 23

Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
CVE-2023-6458 CRITICAL
9.8 Dec 06

Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
CVE-2020-26276 CRITICAL
9.8 Dec 17

Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
CVE-2024-39777 CRITICAL
9.6 Aug 01

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invit
CVE-2020-26290 CRITICAL
9.6 Dec 28

Dex is a federated OpenID Connect provider written in Go. Rated critical severity (CVSS 9.6), this vulnerability is remo
CVE-2026-9354 MEDIUM POC
5.5 May 24

Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers t
CVE-2022-1002 MEDIUM POC
5.4 Mar 18

Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, wh
CVE-2023-2193 CRITICAL
9.1 Apr 20

Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker posse
CVE-2026-7387 HIGH
8.8 Jun 12

Privilege escalation in Mattermost server (11.6.x, 11.5.x, and 10.11.x branches) allows a low-privileged user holding gr
CVE-2026-3524 HIGH
8.8 Apr 06

Authorization bypass in Mattermost Plugin Legal Hold versions <=1.1.4 allows authenticated attackers to manipulate legal

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2026-45498 MEDIUM POC
4.0
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5
CVE-2025-27469 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-9602 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy