CVE-2025-13326

Low · 3.9

CVSS

3.9

EPSS

0.1%

Published

Dec 17, 2025

CISA due date

—

The record

Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.

Affected packages

Ecosystem	Package	Introduced	Fixed