How severe is CVE-2026-8683?

CVE-2026-8683 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-8683 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-8683?

CVE-2026-8683 primarily affects Mattermost Mattermost Desktop. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-8683?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-8683 have an EU (EUVD) identifier?

Yes. CVE-2026-8683 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-36732.

When was CVE-2026-8683 published?

CVE-2026-8683 was published on 2026-06-15 and last updated on 2026-06-17.

CVE-2026-8683

CVE-2026-8683 is a medium-severity vulnerability in Mattermost Mattermost Desktop with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-770.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (10th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-36732
Weakness: CWE-770
Affected product: Mattermost Mattermost Desktop
Published: 2026-06-15
Last modified: 2026-06-17

Description

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a script to call window.open on a very large URL. Mattermost Advisory ID: MMSA-2026-00652

Frequently asked questions

What is CVE-2026-8683?: Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a script to call window.open on a very large URL. Mattermost Advisory ID: MMSA-2026-00652
How severe is CVE-2026-8683?: CVE-2026-8683 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-8683 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-8683?: CVE-2026-8683 primarily affects Mattermost Mattermost Desktop. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-8683?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-8683 have an EU (EUVD) identifier?: Yes. CVE-2026-8683 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-36732.
When was CVE-2026-8683 published?: CVE-2026-8683 was published on 2026-06-15 and last updated on 2026-06-17.

References

https://mattermost.com/security-updates

Affected products (2)

cpe:2.3:a:mattermost:mattermost_desktop:*:-:*:*:*:*:*:*
cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*

More vulnerabilities in Mattermost Mattermost Desktop

CVE-2016-11064 — Critical (CVSS 9.8): An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
CVE-2019-20856 — Critical (CVSS 9.8): An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.
CVE-2019-20861 — High (CVSS 8.8): An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a…
CVE-2026-1046 — High (CVSS 7.6): Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost…
CVE-2020-14456 — High (CVSS 7.3): An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during…
CVE-2026-3471 — Medium (CVSS 6.5): Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in…

All CVEs affecting Mattermost Mattermost Desktop →

Other CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerabilities

CVE-2026-31283 — Critical (CVSS 9.8): In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email…
CVE-2020-37067 — Critical (CVSS 9.8): Filetto 1.0 FTP server contains a denial of service vulnerability in the FEAT command processing that allows attackers…
CVE-2021-47875 — Critical (CVSS 9.8): GeoGebra CAS Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the…
CVE-2025-11832 — Critical (CVSS 9.8): Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access…
CVE-2024-44241 — Critical (CVSS 9.8): The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia…
CVE-2022-3439 — Critical (CVSS 9.8): Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.

Browse all CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerabilities →