CVE-2026-8683

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a script to call window.open on a very large URL. Mattermost Advisory ID: MMSA-2026-00652

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	<= 5.5.13

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Jun 15, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-868307.2Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 migh CVE-2026-868318.7Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an CVE-2026-868325.3The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to CVE-2026-868335.4The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body o CVE-2026-868343.7The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submiss CVE-2026-868368.4In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predicta CVE-2026-868375.3The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauth CVE-2026-868385.3The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appoint CVE-2026-868393.8The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requ CVE-2026-86845.3The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is CVE-2026-868409.1The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A sign CVE-2026-868414.7The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and d