Vulnerability · Published Sep 17, 2026 · Assigned by Mattermost

CVE-2026-12284Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

Low 3.8

In plain English

A low-severity security flaw in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.2%top 94.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Mattermost Advisory ID: MMSA-2026-00699

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	0 – through 6.2.2

Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

MMSA-2026-00699 vendor-advisory