CVE-2024-39767: Mattermost Mobile

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a malicious server to send push notifications with another server’s diagnostic ID or server URL and have them show up in mobile apps as that server’s push notifications.

Affected products

• Mattermost Mattermost Mobile: before 2.17.0 (fixed in 2.17.0)

Published 2024-07-15. Last modified 2026-06-17.