← CVE Intelligence

CVE-2026-1046

Arbitrary application execution via unvalidated server-controlled URLs in Help menu PUBLISHED

Description (CNA)

Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577

Affected (CNA)

Vendor / productVersions
Mattermost / Mattermostaffected 0 through 6.2.0; affected 0 through 5.2.13; unaffected 6.1.0; unaffected 6.0.3.0; unaffected 5.13.3.0

CWE

CWE-939

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.