What is the CVSS score of CVE-2026-9602?

CVE-2026-9602 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Mattermost Desktop CVE-2026-9602

EUVD-2026-45156 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-17 Mattermost

GHSA-82vr-gjvh-q9r8

Denial Of Service Mattermost

6.5

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Attacker must fully own a Mattermost server instance, which is an administrative/high-privilege position, warranting PR:H over the vendor's PR:L; no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 17, 2026 - 11:22 NVD

5.7 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Jul 17, 2026 - 10:47 vuln.today

DescriptionCVE.org

Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash the Mattermost Desktop App via changing the payload of a method to a malformed one. Mattermost Advisory ID: MMSA-2026-00678

AnalysisAI

Mattermost Desktop App across the 5.x and 6.x release branches can be crashed by a malicious server operator through unvalidated inter-process payloads sent from the Mattermost Web App to the Desktop App. The root cause is the absence of payload validation in the Web-to-Desktop communication channel, enabling a server owner to send a malformed method payload that causes uncontrolled processing and application termination on the connected client. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, the network-accessible path and low-complexity exploitation make this a credible denial-of-service threat for organizations running self-hosted Mattermost deployments with untrusted or compromised server administrators.

Technical ContextAI

Mattermost Desktop App is an Electron-based wrapper that hosts the Mattermost web interface and communicates with the underlying desktop process through an internal IPC channel. The vulnerability arises in this Web App-to-Desktop App messaging layer: the Desktop App accepts method call payloads from the embedded web context without enforcing structural or type validation. CWE-400 (Uncontrolled Resource Consumption) is the assigned root cause class, reflecting that a malformed payload triggers unhandled processing that exhausts or corrupts internal state, leading to application crash rather than graceful error recovery. Affected product is identified via CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*, covering the Mattermost Desktop product across multiple release branches.

RemediationAI

Upgrade the Mattermost Desktop App to versions beyond the last-affected releases in each branch (6.x, 6.0.x, and 5.6.x) per the vendor advisory at https://mattermost.com/security-updates; exact patched version numbers per branch should be confirmed there as they are not independently verifiable from the current advisory data. As a compensating control, administrators should restrict Mattermost Desktop clients to connect only to known-trusted, internally controlled Mattermost servers, which eliminates the attack path entirely since exploitation requires attacker server control. Organizations that allow connections to external or partner Mattermost instances should treat patch application as urgent. No side effects of upgrading are anticipated for standard deployments.