CVE-2026-6517mediumCWE-522

Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.2%

probabilidad de explotación

0.2%top 92% de las CVE

explotación observada

noninguna fuente lo reporta

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that routes to an external web server. Mattermost Advisory ID: MMSA-2026-00651

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Productos afectados

Mattermost · Mattermost

Referencias

https://mattermost.com/security-updates