Description
Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Mattermost Mattermost
Default version status: unaffected
9.11.0 to ≤ 9.11.6affected10.4.0 to ≤ 10.4.1affected10.5.0unaffected9.11.7unaffected10.4.2unaffected