CVE-2026-12284: Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler
Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Mattermost Advisory ID: MMSA-2026-00699
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermost Desktop Appto a version that resolves this vulnerability.Fixed in 6.3.0 - Upgrade
Upgrade
Mattermost Desktop Appto a version that resolves this vulnerability.Fixed in 6.2.3.0
Event History
Frequently Asked Questions
Who can trigger the call disconnect?
A malicious or compromised Mattermost server can trigger it, as can a user with script access to a connected server view. The issue affects active calls associated with a different connected server in the desktop app.
What is the practical impact of successful exploitation?
Successful exploitation disconnects an active call through the desktopAPI.leaveCall IPC message. The provided data indicates an availability impact only; it does not indicate confidentiality or integrity impact.
Is user interaction or prior authentication required?
The supplied vector lists no privileges required and no user interaction required. However, the described attack source must be a malicious or compromised server, or a user who has script access to a connected server view.