{"id":"CVE-2026-1046","aliases":["EUVD-2026-6090","GHSA-gjx5-j34g-5g5p"],"status":"published","title":"Arbitrary application execution via unvalidated server-controlled URLs in Help menu","description":"Mattermost Desktop App versions \u003c=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00259,"percentile":0.17634,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-939"],"published":"2026-02-16T12:10:38Z","modified":"2026-10-28T02:30:58Z","products":[{"vendor":"mattermost","product":"mattermost"},{"vendor":"mattermost","product":"mattermost_desktop"}],"references":[{"url":"https://mattermost.com/security-updates","tags":["vendor-advisory","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1046","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gjx5-j34g-5g5p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1046.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-1046","title":"Arbitrary application execution via unvalidated server-controlled URLs in Help menu","description":"Mattermost Desktop App versions \u003c=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577","status":"published","published":"2026-02-16T12:10:38.668Z","modified":"2026-02-17T17:05:58.569Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-939"],"updated_at":"2026-11-02T14:20:01.271368Z"}],"euvd":[{"id":"EUVD-2026-6090","description":"Mattermost Desktop App versions \u003c=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577","status":"published","published":"2026-02-16T12:10:38Z","modified":"2026-02-17T17:05:58Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T19:48:37.939014Z"}],"ghsa":[{"id":"GHSA-gjx5-j34g-5g5p","title":"Mattermost Desktop App versions \u003c=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a...","description":"Mattermost Desktop App versions \u003c=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577","status":"published","published":"2026-02-16T15:32:47Z","modified":"2026-02-16T15:32:54Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-939"],"updated_at":"2026-11-02T15:06:13.684081Z"}],"nvd":[{"id":"CVE-2026-1046","description":"Mattermost Desktop App versions \u003c=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577","status":"published","published":"2026-02-16T13:16:00.793Z","modified":"2026-10-15T13:32:28.463Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-939"],"updated_at":"2026-11-02T14:12:06.274729Z"}],"osv":[{"id":"CVE-2026-1046","title":"Arbitrary application execution via unvalidated server-controlled URLs in Help menu","description":"Mattermost Desktop App versions \u003c=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577","status":"published","published":"2026-02-16T12:10:38.668Z","modified":"2026-10-28T02:30:58.131814656Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-939"],"updated_at":"2026-11-02T15:44:54.236592Z"}]}}