Jesse Hallam

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 9.5.x through 9.5.9 Mattermost versions 9.10.x through 9.10.2 Mattermost versions 9.11.x through 9.11.1 **Description** The issue is related to the lack of authorization procedure in the Mattermost application, which allows an authenticated user to delete an arbitrary post. This is due to the failure to check if the origin of the message in an integration action matches the original post metadata. **Recommendations** For Mattermost versions 9.5.x through 9.5.9, update to a version later than 9.5.9 to resolve the issue. For Mattermost versions 9.10.x through 9.10.2, update to a version later than 9.10.2 to resolve the issue. For Mattermost versions 9.11.x through 9.11.1, update to a version later than 9.11.1 to resolve the issue. As a temporary workaround, consider restricting access to integration actions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mattermost (affected versions not specified) **Description** The issue arises from Mattermost's failure to properly validate permissions when a team member attempts to soft delete a team, allowing them to delete teams they are not part of. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.