---
id: CVE-2025-13326
title: >-
  Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on
  the Mattermost Desktop App when packaged for Mac App Store which allows an
  attacker to inherit TCC permissions via copying the binary to a tmp folder.
summary: >-
  Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on
  the Mattermost Desktop App when packaged for Mac App Store which allows an
  attacker to inherit TCC permissions via copying the binary to a tmp folder.
severity: low
cvss: 3.9
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-693
vendor: mattermost
product: mattermost_desktop
affected:
  - mattermost_desktop < 6.0.0
patched:
  - mattermost_desktop 6.0.0
published: '2025-12-17'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13326'
references:
  - url: 'https://mattermost.com/security-updates'
    label: responsibledisclosure@mattermost.com
tags:
  - nvd
epss: 0.00114
epssPercentile: 0.01362
ingestedAt: '2026-10-13T11:23:51.122Z'
---

## Overview

Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.

## Affected

- `mattermost_desktop < 6.0.0`

## Remediation

Upgrade past the affected range:

- `mattermost_desktop 6.0.0`