The vulnerability allows an attacker to have the desktop application forward NTLM credentials to an attacker-controlled domain that is not on a restricted allow list. The attack can lead to credential theft and subsequent impersonation of legitimate users. The weakness is a failure to enforce a domain allow list, falling under the CWE-522 "Information Exposure Through Unrestricted Credentials".

Mattermost Desktop App versions up to 6.1 and 5.5.13.0 are affected. Users running these releases should upgrade to version 6.2.0, 5.13.6.0 or later to remediate the issue.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is not available, suggesting uncertainty about current exploitation probability. It is not listed in CISA’s KEV catalog, so no active exploits are known at the time of analysis. Based on the description, the likely attack vector is via an embedded image embedded in a message that routes through the client to an attacker‑controlled server, allowing the Credentials to be intercepted.