PT-2025-11503 · Mattermost · Mattermost Desktop App

Nullevent · Published 2025-03-17 · Updated 2025-03-17 · CVE-2025-1398

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Desktop App versions <=5.10.0

Description The issue allows an attacker with remote access to bypass Transparency, Consent, and Control (TCC) via code injection due to explicitly declared unnecessary macOS entitlements.

Recommendations For Mattermost Desktop App versions <=5.10.0, update to a version higher than 5.10.0 to resolve the issue. As a temporary workaround, consider restricting remote access to the application until a patch is available.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2025-16009

CVE-2025-1398

GHSA-XMVV-W44W-J8WX

Affected Products

Mattermost Desktop App

References · 10

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xmvv-w44w-j8wx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1398 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1398 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16009 · Security Note
• https://github.com/mattermost/desktop · Note
• https://twitter.com/CveFindCom/status/1901649959465681355 · Twitter Post
• https://t.me/cvedetector/20475 · Telegram Post
• https://t.me/cvetracker/19287 · Telegram Post
• https://twitter.com/CVEnew/status/1901647335425450229 · Twitter Post