daw10

Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels

Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Password Change Bypass via Auth Switch Endpoint

Authentication bypass via userID login when email and username login are disabled

Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controls

Mattermost Zoom Plugin channel preference API lacks authorization checks

IDOR in board file download allows any user to download any file by UUID

Admin RCE via prepackaged plugins by way of misconfigured imports directory

Weak cache keys lead to post IDOR and link preview poisoning

Mattermost Server exposes sensitive user credentials during shared channel membership synchronization