{"id":"CVE-2026-75588","published":"2026-09-17T16:17:41.940","lastModified":"2026-09-18T13:46:33.503","description":"Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Mattermost Advisory ID: MMSA-2026-00717","cvssScore":2.6,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","cwes":["CWE-1287"],"vendors":[],"products":[],"references":[{"url":"https://mattermost.com/security-updates","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}