ByteOS Network

CVE Vulnerability Details :

CVE-2026-1046

PUBLISHED

More Info Official Page

Assigner-Mattermost

Assigner Org ID-9302f53e-dde5-4bf3-b2f2-a83f91ac0eee

Published At-16 Feb, 2026 | 12:10

Updated At-16 Feb, 2026 | 12:10

▼CVE Numbering Authority (CNA)

Arbitrary application execution via unvalidated server-controlled URLs in Help menu

Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577

Affected Products

Vendor

Mattermost, Inc.

Product

Mattermost

Default Status

unaffected

Versions

Affected

From 0 through 6.2.0 (semver)
From 0 through 5.2.13 (semver)

Unaffected

6.1.0
6.0.3.0
5.13.3.0

Problem Types

Type	CWE ID	Description
CWE	CWE-939	CWE-939: Improper Authorization in Handler for Custom URL Scheme

Type: CWE

CWE ID: CWE-939

Description: CWE-939: Improper Authorization in Handler for Custom URL Scheme

Metrics

Version	Base score	Base severity	Vector
3.1	7.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L

Version: 3.1

Base score: 7.6

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L

Solutions

Update Mattermost Desktop App to versions 6.1.0, 6.0.3.0, 5.13.3.0 or higher.

Credits

finder

hackerman70000

References

Hyperlink	Resource
https://mattermost.com/security-updates	vendor-advisory

Hyperlink: https://mattermost.com/security-updates

Resource:

vendor-advisory

Affected Products

Affected

Unaffected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References