CVE-2026-1628
Received Received - Intake
Preload Script Exposure in Mattermost Desktop

Publication date: 2026-03-02

Last updated on: 2026-03-05

Assigner: Mattermost, Inc.

Description
Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-02
Last Modified
2026-03-05
Generated
2026-06-16
AI Q&A
2026-03-02
EPSS Evaluated
2026-06-15
NVD
CVE-2026-1628
EUVD
EUVD-2026-9174
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mattermost mattermost_desktop to 5.13.4 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

Mattermost Desktop App versions up to and including 5.13.3 have a vulnerability where they fail to attach listeners that restrict navigation to external sites within the app. This flaw allows a malicious server to expose preload script functionality to untrusted servers if a user opens an external link in their Mattermost server.

Impact Analysis

This vulnerability can allow a malicious server to exploit the preload script functionality by tricking a user into opening an external link. This could lead to limited confidentiality and integrity impacts, as indicated by the CVSS score, potentially exposing sensitive information or allowing manipulation of data within the app.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1628. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart