What is the CVSS score of EUVD-2026-30758?

EUVD-2026-30758 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Mattermost Desktop App EUVD-2026-30758

Q: Which versions of Mattermost Desktop App are affected by EUVD-2026-30758?

Mattermost Desktop App can be crashed remotely by malicious server administrators or plugin developers exploiting insufficient isolation of server-rendered content.

| CVE-2026-4643 LOW

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-05-18 Mattermost

GHSA-mf43-g8vp-9q4m

Mattermost Denial Of Service

3.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 09:31 vuln.today

DescriptionCVE.org

Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desktop App which allows a malicious server or plugin to crash the desktop client via invoking {{window.close()}} in the renderer context, leading to a denial of service condition at the client level. Mattermost Advisory ID: MMSA-2026-00633

AnalysisAI

Mattermost Desktop App can be crashed remotely by malicious server administrators or plugin developers exploiting insufficient isolation of server-rendered content. Authenticated attackers with low-privilege server access who can control rendered content (via compromised server, malicious plugin, or modified server responses) can invoke window.close() to terminate the desktop client, causing a client-side denial of service. EPSS data not available; no public exploit code identified at time of analysis. CVSS 3.5 (Low severity) reflects limited impact scope - disruption to individual user sessions rather than system-wide compromise.

Technical ContextAI

The Mattermost Desktop App uses Electron or similar framework to render server content within desktop application views. The vulnerability stems from improper context isolation (CWE-754: Improper Check for Unusual or Exceptional Conditions) where server-controlled HTML/JavaScript can access window management APIs in the renderer process. Affected CPE is cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* covering versions through 6.1, 6.0.1, and 5.4.13.0. In secure Electron applications, renderer processes should be sandboxed with contextIsolation enabled and nodeIntegration disabled to prevent server content from invoking privileged APIs like window.close(). This architectural flaw allows untrusted server-rendered content to break the application boundary and control the desktop client lifecycle.

RemediationAI

Upgrade Mattermost Desktop App to the patched version specified in MMSA-2026-00633 advisory at https://mattermost.com/security-updates (exact fixed version not provided in available data - consult vendor advisory for release number). Organizations unable to immediately patch can implement compensating controls: restrict desktop client connections to trusted Mattermost servers only via endpoint management policies or network access controls, disable or audit third-party plugins on Mattermost servers (as plugins can inject arbitrary client-side code), and educate users not to connect desktop clients to untrusted or community-hosted Mattermost instances. Note that blocking JavaScript entirely would break core Mattermost functionality. For high-security environments, consider mandating web client usage until desktop app is patched, though this reduces offline functionality and user experience.