Joram Wilander

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 9.11.x through 9.11.8 **Description** The issue concerns the lack of explicit approval before adding a team admin to a private channel. This allows team admins to join private channels via crafted permalink links without explicit consent. **Recommendations** For Mattermost versions 9.11.x through 9.11.8, consider restricting access to private channels until a fix is available, and ensure that team admins are aware of the potential for unauthorized access to these channels.