CVE-2026-8683

Vulnerability

In Mattermost Desktop App versions ≤5.5.13.0 and ≤6.1, the application does not properly handle attempts to open extremely long URLs. When a malicious server owner includes a script that calls window.open with a very large URL, the desktop client fails to account for the size of the URL, leading to a crash of the application [1].

Exploitation

An attacker who controls a Mattermost server (e.g., a malicious server owner) can craft a message or integrate a script that triggers window.open with an excessively long URL. No special user interaction beyond normal usage of the app is required; the client will process the long URL and crash as a result [1].

Impact

Successful exploitation causes the Mattermost Desktop App to crash, resulting in a denial of service. The attacker does not gain code execution or data access, but the repeated crashing can disrupt user workflow and effectively prevent the victim from using the desktop client [1].

Mitigation

Mattermost has released security updates to address this issue. Users should upgrade to Mattermost Desktop App versions later than 5.5.13.0 or 6.1. The fix is included in the security update described in MMSA-2026-00652 [1]. For users unable to upgrade immediately, no workaround is documented in the available references.