CVE-2026-12284 Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

Q: Is CVE-2026-12284 being exploited?

There is no known exploitation of CVE-2026-12284 in the wild and no public exploit code.

Q: How do I fix CVE-2026-12284?

No fix has been published for CVE-2026-12284 yet. Limit exposure of the affected software until one is available.

Low 3.8 Published 17 Sep 2026 Updated 17 Sep 2026

A malicious server can disconnect active calls on other connected servers due to missing IPC sender validation in the Mattermost Desktop App.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-12284?

CVE-2026-12284 is a low-severity missing authorization vulnerability in Mattermost, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Mattermost Advisory ID: MMSA-2026-00699

Weakness: CWE-346

Which versions are affected by CVE-2026-12284?

It affects 1 product.

Products include Mattermost Mattermost Desktop.

How do I fix CVE-2026-12284?

No fix has been published for CVE-2026-12284 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-12284 being exploited?

There is no known exploitation of CVE-2026-12284 in the wild and no public exploit code.

Sources

Also known as GHSA-q4vh-9cg5-4q62.