CVE-2026-6517mediumCWE-522

Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.2%

probabilidade de exploração

0.2%top 91% das CVEs

exploração observada

nãonenhuma fonte reporta

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that routes to an external web server. Mattermost Advisory ID: MMSA-2026-00651

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Produtos afetados

Mattermost · Mattermost

Referências

https://mattermost.com/security-updates