Server-rendered content in the Mattermost Desktop App may invoke window.close on the renderer side, causing the client application to crash. This flaw results in a local denial of service condition, interrupting user activity without affecting any remote systems or other network services. The weakness arises from a lack of verification before allowing window.close to execute, which aligns with CWE-754.

Mattermost Desktop App versions 6.1.0 and earlier, including 6.0.1 and 5.4.13.0, are affected. The vendor is Mattermost and the product is the Mattermost Desktop App.

The CVSS score of 3.5 indicates low severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector demands a malicious or compromised server or plugin that serves executable content to the client. Exploitation would require the client to load the content, so while exploitation is straightforward for a targeted user, broad remote exploitation is unlikely.