GHSA-xmvv-w44w-j8wx

ghsaUSosv

Mattermost Desktop App allows the bypass of Transparency, Consent, and Control (TCC) via code injection

view advisory published 2025-03-17Licence: CC-BY-4.0

Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and Control (TCC) via code injection.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-1398US	—	0.17% (7th)	—	2025-03-17
Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and Control…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/desktopPACKAGE
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-1398ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan