BaseFortify

Publication date: 2025-12-17

Last updated on: 2025-12-18

Assigner: Mattermost, Inc.

Description

Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-17

Last Modified

2025-12-18

Generated

2026-07-06

AI Q&A

2025-12-17

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13326

EUVD

EUVD-2025-203922

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost_desktop	to 6.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

Mattermost Desktop App versions prior to 6.0.0 do not enable the Hardened Runtime when packaged for the Mac App Store. This allows an attacker to copy the app binary to a temporary folder and inherit TCC (Transparency, Consent, and Control) permissions, potentially bypassing security restrictions.

Impact Analysis

This vulnerability can allow an attacker with limited privileges to gain access to permissions normally granted to the Mattermost Desktop App, potentially leading to unauthorized access to protected resources or data on a Mac system.

Hi! I’m here to help you understand CVE-2025-13326. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70