Vulnerability Details CVE-2026-9602
Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash the Mattermost Desktop App via changing the payload of a method to a malformed one. Mattermost Advisory ID: MMSA-2026-00678
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 14.5%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-9602
-
cpe:2.3:a:mattermost:mattermost_desktop:*
-
cpe:2.3:a:mattermost:mattermost_desktop:5.10.0
-
cpe:2.3:a:mattermost:mattermost_desktop:5.10.1
-
cpe:2.3:a:mattermost:mattermost_desktop:5.10.2
-
cpe:2.3:a:mattermost:mattermost_desktop:5.11.0
-
cpe:2.3:a:mattermost:mattermost_desktop:5.11.1
-
cpe:2.3:a:mattermost:mattermost_desktop:5.11.2
-
cpe:2.3:a:mattermost:mattermost_desktop:5.11.3
-
cpe:2.3:a:mattermost:mattermost_desktop:5.12.0
-
cpe:2.3:a:mattermost:mattermost_desktop:5.12.1
-
cpe:2.3:a:mattermost:mattermost_desktop:5.13.0
-
cpe:2.3:a:mattermost:mattermost_desktop:5.13.1
-
cpe:2.3:a:mattermost:mattermost_desktop:5.13.2
-
cpe:2.3:a:mattermost:mattermost_desktop:5.13.3
-
cpe:2.3:a:mattermost:mattermost_desktop:5.7.0
-
cpe:2.3:a:mattermost:mattermost_desktop:5.8.0
-
cpe:2.3:a:mattermost:mattermost_desktop:5.8.1
-
cpe:2.3:a:mattermost:mattermost_desktop:5.9.0
-
cpe:2.3:a:mattermost:mattermost_desktop:5.9.1
-
cpe:2.3:a:mattermost:mattermost_desktop:5.9.2
-
cpe:2.3:a:mattermost:mattermost_desktop:6.0.2
-
cpe:2.3:a:mattermost:mattermost_desktop:6.0.3
-
cpe:2.3:a:mattermost:mattermost_desktop:6.0.4
-
cpe:2.3:a:mattermost:mattermost_desktop:6.1.0
-
cpe:2.3:a:mattermost:mattermost_desktop:6.2.0