CVE-2026-1046

Name of the Vulnerable Software and Affected Versions Mattermost versions 5.2.13.0 and earlier, versions 6.0 and 6.2.0 and earlier

Description The Mattermost Desktop App does not properly validate help links. This allows a malicious Mattermost server to execute arbitrary executables on a user’s system when a user clicks on specific items within the Help menu. The issue involves unvalidated server-controlled URLs in the Help menu.

Recommendations Update Mattermost to a version later than 5.2.13.0. Update Mattermost to a version later than 6.0. Update Mattermost to a version later than 6.2.0.