Mattermost Desktop App Code Injection Vulnerability Allowing TCC Bypass on macOS

A vulnerability exists in the Mattermost Desktop App for macOS, specifically in versions through 5.10.0. The issue arises from the app explicitly declaring unnecessary macOS entitlements, which can be exploited by an attacker with remote access to inject code. This code injection allows the attacker to bypass Transparency, Consent, and Control (TCC) restrictions.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution on the user's machine, allowing the attacker to bypass macOS privacy controls.

Remediation

Users are advised to update to the latest version of the Mattermost Desktop App. The latest version can be downloaded from the Mattermost website.