CVE-2025-13326

LowCVSS 3.9/10Last modified Oct 13, 2026

Description

Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.

Metrics

CVSS 3.1 3.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published
Dec 17, 2025
Last modified
Oct 13, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-133276.3A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via speciaCVE-2025-133299.8The File Uploader for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the caCVE-2025-13336.5IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0CVE-2025-133334.9IBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings.CVE-2025-133348.1The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized database resets and file deletion due to a missing capability cheCVE-2025-133356.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 thCVE-2025-133397.5The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via tCVE-2025-13344.0IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 allows web pages to be storedCVE-2025-133429.8The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versiCVE-2025-133435.4A security flaw has been discovered in SourceCodester Interview Management System 1.0. Affected is an unknown function of the file /editQuesCVE-2025-133449.8A weakness has been identified in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is an unknown functionalCVE-2025-133458.8A security vulnerability has been detected in SourceCodester Train Station Ticketing System 1.0. Affected by this issue is some unknown func