PT-2025-11503

CVE-2025-1398

Published

2025-03-17

Updated

2025-03-17

Description by

CVSS 3.1

3.3

Low

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Desktop App versions <=5.10.0

Description The issue allows an attacker with remote access to bypass Transparency, Consent, and Control (TCC) via code injection due to explicitly declared unnecessary macOS entitlements.

Recommendations For Mattermost Desktop App versions <=5.10.0, update to a version higher than 5.10.0 to resolve the issue. As a temporary workaround, consider restricting remote access to the application until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Nullevent

Vendors

Affected products

Weakness enumeration

CWE-426: Untrusted Search Path

Related identifiers

CVE-2025-1398