How severe is CVE-2026-3471?

CVE-2026-3471 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-3471 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-3471?

CVE-2026-3471 affects Mattermost Mattermost Desktop. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-3471?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-3471 have an EU (EUVD) identifier?

Yes. CVE-2026-3471 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-30757.

When was CVE-2026-3471 published?

CVE-2026-3471 was published on 2026-05-18 and last updated on 2026-06-17.

CVE-2026-3471

CVE-2026-3471 is a medium-severity vulnerability in Mattermost Mattermost Desktop with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-939.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (8th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-30757
Weakness: CWE-939
Affected product: Mattermost Mattermost Desktop
Published: 2026-05-18
Last modified: 2026-06-17

Description

Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618

Frequently asked questions

What is CVE-2026-3471?: Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618
How severe is CVE-2026-3471?: CVE-2026-3471 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-3471 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-3471?: CVE-2026-3471 affects Mattermost Mattermost Desktop. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-3471?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-3471 have an EU (EUVD) identifier?: Yes. CVE-2026-3471 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-30757.
When was CVE-2026-3471 published?: CVE-2026-3471 was published on 2026-05-18 and last updated on 2026-06-17.

References

https://mattermost.com/security-updates

Affected products (1)

cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*

More vulnerabilities in Mattermost Mattermost Desktop

CVE-2016-11064 — Critical (CVSS 9.8): An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
CVE-2019-20856 — Critical (CVSS 9.8): An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.
CVE-2019-20861 — High (CVSS 8.8): An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a…
CVE-2026-1046 — High (CVSS 7.6): Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost…
CVE-2020-14456 — High (CVSS 7.3): An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during…
CVE-2026-8683 — Medium (CVSS 6.5): Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the…

All CVEs affecting Mattermost Mattermost Desktop →

Other CWE-939 vulnerabilities

CVE-2024-33606 — High (CVSS 8.8): An attacker could retrieve sensitive files (medical images) as well as plant new medical images or overwrite existing…
CVE-2026-6445 — High (CVSS 8.7): A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive…
CVE-2026-35394 — High (CVSS 8.3): Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in…
CVE-2026-53408 — High (CVSS 8.1): Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before…
CVE-2026-53407 — High (CVSS 8.1): Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before…
CVE-2026-33335 — High (CVSS 8.0): Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0,…

Browse all CWE-939 vulnerabilities →