CVE-2026-1046

MediumCVSS 6.5/10Last modified Oct 15, 2026

Description

Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-939

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2026
Last modified: Oct 15, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1046066.3A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the CVE-2026-1046097.3A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the CVE-2026-10461010.0A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /bo CVE-2026-1046119.1A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the CVE-2026-1046124.3A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/c CVE-2026-1046136.3A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /Simp CVE-2026-1046146.3A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /S CVE-2026-1046175.1There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc acc CVE-2026-1046186.2On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, ho CVE-2026-1046256.3A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index CVE-2026-1046268.8A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that i CVE-2026-1046275.4The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in