PT-2025-51855 · Mattermost · Mattermost Desktop App

Karmaz95 · Published 2025-12-17 · Updated 2025-12-17 · CVE-2025-13326

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions prior to 6.0.0

Description The Mattermost Desktop App does not enable the Hardened Runtime when packaged for the Mac App Store for versions prior to 6.0.0. This allows an attacker to obtain TCC permissions by copying the application binary to a temporary folder. TCC (Transparency, Consent, and Control) is a macOS security feature that manages user permissions for accessing protected resources. Inheriting these permissions could allow unauthorized access to sensitive data.

Recommendations Update to Mattermost Desktop App version 6.0.0 or later.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2025-13326

Affected Products

Mattermost Desktop App

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-13326 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13326 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2001406256557269090 · Twitter Post
• https://twitter.com/CVEnew/status/2001365741145080319 · Twitter Post
• https://t.me/CVEtracker/40060 · Telegram Post