CVE-2026-4643: Mattermost Desktop App DoS Vulnerability

CVE-2026-4643 Overview

CVE-2026-4643 affects Mattermost Desktop App versions <=6.1, 6.0.1, and 5.4.13.0. The application fails to prevent server-rendered content from closing an underlying application view. A malicious server or plugin can invoke window.close() in the renderer context to crash the desktop client. The result is a denial of service condition at the client level. This issue is tracked under Mattermost Advisory ID MMSA-2026-00633 and categorized as CWE-754: Improper Check for Unusual or Exceptional Conditions.

Critical Impact

A malicious Mattermost server or plugin can crash the Desktop App by invoking window.close() from server-rendered content, producing a client-side denial of service.

Affected Products

• Mattermost Desktop App versions <=6.1
• Mattermost Desktop App version 6.0.1
• Mattermost Desktop App version 5.4.13.0

Discovery Timeline

• 2026-05-18 - CVE-2026-4643 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-4643

Vulnerability Analysis

The Mattermost Desktop App is built on a renderer that loads content provided by the connected server. The flaw allows server-rendered content to control the lifecycle of the underlying application view. When a malicious server or plugin injects a call to window.close() into the renderer context, the desktop client treats it as a legitimate close instruction. The application view terminates, producing a client-side crash.

The attack does not require code execution or data access. It targets the availability of the desktop client only. An authenticated user must interact with the malicious server or plugin for the condition to trigger, reflecting the user interaction requirement in the CVSS vector.

The weakness maps to CWE-754: Improper Check for Unusual or Exceptional Conditions. The renderer does not validate or block server-originated calls that affect the host application window lifecycle.

Root Cause

The Desktop App does not isolate the renderer context from privileged window operations. Server-rendered content can issue window.close() and have it propagate to the underlying application view rather than being scoped to the embedded content frame. The application lacks an exceptional-condition check that would distinguish legitimate user-initiated closure from server-injected closure.

Attack Vector

An attacker controls either a malicious Mattermost server or a malicious plugin loaded by a legitimate server. The attacker delivers content containing window.close() to the renderer. When the victim's Desktop App renders the content, the call executes against the underlying view. The client crashes, requiring the user to restart the application to restore functionality.

No verified public exploit code is available for CVE-2026-4643. Refer to the Mattermost Security Updates page for vendor technical details.

Detection Methods for CVE-2026-4643

Indicators of Compromise

• Repeated, unexpected terminations of the Mattermost Desktop App process on user endpoints shortly after connecting to a specific server or loading a specific channel.
• Client error or crash logs referencing renderer shutdown or window close events that do not correlate with user-initiated quit actions.
• Outbound connections from the Desktop App to untrusted or newly observed Mattermost server endpoints prior to the crash.

Detection Strategies

• Correlate Desktop App process exits with active server connections to identify servers that consistently precede crashes.
• Monitor for installation of unapproved Mattermost plugins on managed servers, particularly plugins that render custom content in the client.
• Inspect Mattermost Desktop App logs for renderer-level close events that originate from server-pushed content rather than UI input.

Monitoring Recommendations

• Track Mattermost Desktop App version inventory across endpoints to identify hosts running <=6.1, 6.0.1, or 5.4.13.0.
• Alert on connections from corporate Desktop App installations to Mattermost servers outside an approved allowlist.
• Review plugin install and update events on self-hosted Mattermost servers for unauthorized additions.

How to Mitigate CVE-2026-4643

Immediate Actions Required

• Upgrade the Mattermost Desktop App to a fixed release as published on the Mattermost Security Updates page.
• Restrict the Desktop App to connecting only to trusted, organization-controlled Mattermost servers.
• Audit installed server plugins and remove any that are not required or not from a trusted source.

Patch Information

Mattermost has issued advisory MMSA-2026-00633 for this issue. Upgrade guidance and fixed version information are available from the Mattermost Security Updates page. Apply the vendor-provided update to all endpoints running the affected Desktop App versions.

Workarounds

• Limit Desktop App usage to vetted internal Mattermost servers until all clients are patched.
• Disable or restrict plugin installation on Mattermost servers to administrators only.
• Instruct users to report repeated unexpected Desktop App crashes so administrators can identify potentially malicious server content.