PT-2026-94365
CVE-2026-75588
·
Published
2026-09-17
·
Updated
2026-10-13
Description by
CVSS 3.1
2.6
LowMetricsAV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Mattermost Desktop App versions prior to 6.2.2.0
Description
The application fails to validate the URL scheme when verifying if a target URL is internal to the connected server. This allows a network-positioned attacker to load a plugin popout window over an insecure connection by using a link with a downgraded URL scheme.
Recommendations
Update Mattermost Desktop App to version 6.2.2.0 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾