CVE-2025-13326

Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.

CVSS v3 3.9 LOW

3.9^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.3 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*

History

13 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Las versiones menor que 6.0.0 de la aplicación de escritorio de Mattermost no habilitan el Hardened Runtime en la aplicación de escritorio de Mattermost cuando se empaqueta para la Mac App Store, lo que permite a un atacante heredar permisos TCC mediante la copia del binario a una carpeta temporal.

Information

Published : 2025-12-17 19:16

Updated : 2026-10-13 11:10

NVD link : CVE-2025-13326

Mitre link : CVE-2025-13326

CVE.ORG link : CVE-2025-13326

JSON object : View

Products Affected

mattermost

mattermost_desktop

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2025-13326", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13326", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-17T18:52:17.808716Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.3}]}, "affected": [{"source": "responsibledisclosure@mattermost.com", "affectedData": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.0.0"}, {"status": "unaffected", "version": "6.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-17T19:16:01.237", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder."}, {"lang": "es", "value": "Las versiones menor que 6.0.0 de la aplicaci\u00f3n de escritorio de Mattermost no habilitan el Hardened Runtime en la aplicaci\u00f3n de escritorio de Mattermost cuando se empaqueta para la Mac App Store, lo que permite a un atacante heredar permisos TCC mediante la copia del binario a una carpeta temporal."}], "lastModified": "2026-10-13T11:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DD607D2-5B4D-49F7-AB83-2DAD88C94DB8", "versionEndExcluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}