CVE-2026-1628 — Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.

CVE-2026-1628

Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites. PUBLISHED

Description (CNA)

Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 0 through 5.13.3; unaffected 5.13.4.0

CWE

CWE-829

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.