Description
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attacker to spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint.. Mattermost Advisory ID: MMSA-2025-00569
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Mattermost Mattermost
Default version status: unaffected
11.3.0 to ≤ 11.3.0affected11.2.0 to ≤ 11.2.2affected10.11.0 to ≤ 10.11.10affected11.4.0unaffected11.3.1unaffected11.2.3unaffected10.11.11unaffected