CVE-2026-75588 Mattermost CVE debrief

Who should care

Defenders responsible for Mattermost Desktop App deployments should assess exposure and prioritize verifying affected versions. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify affected versions, assess exposure, and implement secure connections for plugin popout windows to prevent potential insecure connections.

Why it matters

The Mattermost Desktop App vulnerability CVE-2026-75588 allows network-positioned attackers to load plugin popout windows over insecure connections, requiring defenders to verify affected versions and assess exposure.

• Verification of affected versions and exposure is necessary to prevent potential insecure connections.
• Defenders should assess the risk of plugin popout windows being loaded over insecure connections.
• Prioritization of secure connections for plugin popout windows is crucial to prevent exploitation.

Technical summary

The Mattermost Desktop App fails to validate the URL scheme when checking whether a target URL is internal to the connected server, allowing a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. This issue affects versions <=6.2 6.2.2.0 of the Mattermost Desktop App and has been assigned a CVSS score of 2.6. The vulnerability requires defenders to verify affected versions and assess exposure to prevent potential insecure connections. The CVE record and NVD vulnerability detail page provide additional information on the vulnerability.

Defensive priority

Defenders should prioritize verifying the affected versions and assessing exposure, as this vulnerability could lead to insecure connections.

Recommended defensive actions

• Verify the affected versions of Mattermost Desktop App and assess exposure
• Implement secure connections for plugin popout windows
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its CVSS score, and affected versions. The Mattermost Advisory ID is MMSA-2026-00717. The vulnerability affects Mattermost Desktop App versions <=6.2 6.2.2.0. The CVE record was published on 2026-09-17T16:17:41.940Z and was last modified on 2026-09-18T13:46:33.503Z. Evidence is limited to public sources and may not be comprehensive.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.