CVE-2025-13326: 
Mattermost Desktop App vulnerability analysis and mitigation

CVE-2025-13326 is a protection mechanism failure in the Mattermost Desktop App for macOS that allows a local attacker to inherit Transparency, Consent, and Control (TCC) permissions by copying the application binary to a temporary folder. The vulnerability affects all Mattermost Desktop App versions prior to 6.0.0 when packaged for the Mac App Store, as the app fails to enable the macOS Hardened Runtime entitlement. It was published on December 17, 2025, with a CVSS v3.1 base score of 3.9 (Low) (Red Hat CVE, Mattermost Security).

The root cause is classified as CWE-693 (Protection Mechanism Failure): the Mattermost Desktop App, when distributed via the Mac App Store, does not enable the macOS Hardened Runtime, a security feature that restricts code injection, dynamic library loading, and other runtime tampering. Without Hardened Runtime enabled, the application binary can be copied to a world-writable directory (e.g., /tmp) and executed in a context that inherits the original app's TCC permissions — such as access to the microphone, camera, or contacts — without user re-authorization. Exploitation requires local access, low privileges, and user interaction, limiting the attack surface to authenticated local users on affected macOS systems (Red Hat CVE, Mattermost Security).

Successful exploitation allows a low-privileged local attacker to bypass macOS TCC security controls and inherit sensitive permissions originally granted to the Mattermost Desktop App, potentially including access to the microphone, camera, contacts, or other protected resources. Both confidentiality and integrity are impacted at a low level, while availability is unaffected. The scope is limited to the local system and does not enable remote code execution or privilege escalation beyond TCC permission inheritance (Red Hat CVE).

1. Reconnaissance: Identify a macOS system running Mattermost Desktop App installed from the Mac App Store with a version prior to 6.0.0, where Hardened Runtime is not enforced.
2. Locate the binary: As a low-privileged local user, locate the Mattermost Desktop App binary within the application bundle (e.g., /Applications/Mattermost.app/Contents/MacOS/Mattermost).
3. Copy binary to tmp: Copy the application binary to a world-writable directory such as /tmp/ — e.g., cp /Applications/Mattermost.app/Contents/MacOS/Mattermost /tmp/Mattermost.
4. Execute copied binary: Run the copied binary from the tmp location. Because Hardened Runtime is not enabled, macOS does not enforce code-signing restrictions, allowing the binary to execute and inherit the TCC permissions previously granted to the original app.
5. Inherit TCC permissions: The attacker's process now operates with the inherited TCC entitlements (e.g., microphone, camera, contacts access), bypassing the normal user-consent prompts that would otherwise be required (Red Hat CVE, Mattermost Security).

• File System: Presence of the Mattermost binary or a copy of it in world-writable directories such as /tmp/, /var/folders/, or other temporary paths outside the standard application bundle location.
• Process: Mattermost-named processes spawned from paths other than /Applications/Mattermost.app/ or the user's ~/Applications/ directory.
• Logs: macOS Unified Log entries (via log show) indicating TCC permission grants or access events attributed to a binary running from a temporary directory; tccd log entries showing permission inheritance for unexpected process paths.
• File System: Unexpected copies or hard links of the Mattermost binary with modified timestamps in /tmp or similar locations.

Mattermost has addressed this vulnerability in Mattermost Desktop App version 6.0.0, which enables the Hardened Runtime entitlement for Mac App Store builds. Users should upgrade to version 6.0.0 or later immediately via the Mac App Store. As interim mitigations, administrators should restrict local user access on macOS systems, apply the principle of least privilege, and monitor for unauthorized binary manipulations or processes running from temporary directories (Mattermost Security).