CVE-2026-75588CWE-1287

CVE-2026-75588

Low · published September 17, 2026

CVSS v3.1
2.6
EPSS
0%
Percentile
12.3
In the wild
Unconfirmed
What it is

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Mattermost Advisory ID: MMSA-2026-00717

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00224 · 12.3th percentile
Weakness
CWE-1287 · Improper Validation of Specified Type of Input
Published
2026-09-17T20:17Z
Affected products (1)
ProductVersionsFixed in
mattermost/mattermost_desktop≥ 6.2.0, < 6.2.36.2.3
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 19 SEP 03:54Z
    EPSS moved — → 0%
    epss
  • 17 SEP 15:09Z
    Mattermost Desktop App plugin popout scheme validation bypass
    cvelistv5