Mattermost Desktop App allows the bypass of Transparency, Consent, and Control (TCC) via code injection

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-1398 · ADVISORY
• mattermost/desktop · PACKAGE
• mattermost.com/security-updates · WEB

More vulnerabilities in mattermost desktop

• CVE-2026-75588LOW 2.6Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connecte…
• CVE-2026-12284LOW 3.7Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromi…
• CVE-2026-75025MEDIUM 4.7Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content …
• CVE-2026-75587LOW 3.3Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local …
• CVE-2026-9602MEDIUM 6.5Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which all…