Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestions search

All statuses
Filter by:
With package: mattermost-desktop

Found 112 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-3524
8.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 5 months, 2 weeks ago Activity log
  • Created suggestion 5 months, 2 weeks ago
Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check

Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621

References

Affected products

Mattermost
  • =<1.1.4
  • ==1.1.5

Matching in nixpkgs

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

  • nixos-unstable -
  • nixos-26.05 -

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

  • nixos-unstable -
  • nixos-26.05 -

Package maintainers

Published
Permalink CVE-2026-1628
4.6 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    5 packages
    • mattermost
    • mattermostLatest
    • python312Packages.mattermostdriver
    • python313Packages.mattermostdriver
    • python314Packages.mattermostdriver
    6 months, 3 weeks ago
  • @LeSuisse deleted
    2 maintainers
    • @liff
    • @jokogr
    6 months, 3 weeks ago maintainer.delete
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago
Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.

Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596

References

Affected products

Mattermost
  • =<5.13.3
  • ==5.13.4.0

Matching in nixpkgs

Ignored packages (5)

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

Package maintainers

Ignored maintainers (2)