CVE-2026-75588: Mattermost Desktop App plugin popout scheme validation bypass
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Mattermost Advisory ID: MMSA-2026-00717
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.3.0
Event History
Frequently Asked Questions
What access and user action are required for exploitation?
The attacker must be in a network position to interfere with the connection, have low privileges, and induce user interaction with a link that uses a downgraded URL scheme.
What is the expected security impact?
The stated impact is limited to integrity. No confidentiality or availability impact is indicated by the provided severity vector.
Which installations should be reviewed?
Review Mattermost Desktop App installations reported as versions <=6.2 6.2.2.0. The issue concerns plugin popout windows associated with the connected server.