Riskcovery

CVE-2026-4643

Calling window.close() from server-side content causes crash in the Mattermost Desktop App

State
Published
Severity
3.5 Low
Published
May 18, 2026
Updated
May 18, 2026
Reserved
Mar 23, 2026

Read the record on cve.org

Description

Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desktop App which allows a malicious server or plugin to crash the desktop client via invoking {{window.close()}} in the renderer context, leading to a denial of service condition at the client level. Mattermost Advisory ID: MMSA-2026-00633

Scores

CVSSScoreVectorSource
3.13.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:LMattermost

Weaknesses

  • CWE-754 Improper Check for Unusual or Exceptional Conditions

Affected Products

ProductVersions
MattermostMattermost
  • 6.0.1 and earlierAffected
  • 5.4.13 and earlierAffected
  • 6.2.0Not affected
  • 6.1.1.0Not affected
  • 5.13.5.0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.