CVE-2025-13326 Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store

Q: Is CVE-2025-13326 being exploited?

There is no known exploitation of CVE-2025-13326 in the wild and no public exploit code.

Q: How do I fix CVE-2025-13326?

No fix has been published for CVE-2025-13326 yet. Limit exposure of the affected software until one is available.

Low 3.9 Published 17 Dec 2025 Updated 17 Dec 2025

Attackers can bypass macOS Hardened Runtime to inherit TCC permissions and access sensitive data by copying the binary.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-13326?

CVE-2025-13326 is a low-severity vulnerability in Mattermost, published on 17 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.

Weakness: CWE-693

Which versions are affected by CVE-2025-13326?

It affects 1 product.

Products include Mattermost Mattermost Desktop.

How do I fix CVE-2025-13326?

No fix has been published for CVE-2025-13326 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-13326 being exploited?

There is no known exploitation of CVE-2025-13326 in the wild and no public exploit code.

Sources

Also known as GHSA-4m4m-vm74-rqv4.