hackit_BhaRat

Improper Permission Check Allows User Manager to Deactivate Bot Accounts

Team Admin Privilege Escalation to Demote Members to Guest

Channel and Team Membership APIs inadvertently allow loss of Member privileges.

Mattermost Guest User Information Disclosure Vulnerability

Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions

Unauthorized Guest user access to Playbook

Unauthorized View Access to Archived Channel Member Info

Channel metadata visible in archived channels despite configuration setting

Unauthorized Command Execution in Archived Channels

Unauthorized email invite to a private channel