CVE-2026-1628CWE-829

Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.

Medium · published March 2, 2026

CVSS v3.1
4.6
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00144 · 3.4th percentile
Weakness
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2026-03-02T13:24Z
EPSS history
Timeline
  • 02 MAR 13:24Z
    Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.
    cvelistv5