Description
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions which allows a guest user to post files in channels where they lack upload_file permission via uploading files in a team where they have permission and reusing the file metadata in a POST request to a different team. Mattermost Advisory ID: MMSA-2025-00553
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Mattermost Mattermost
Default version status: unaffected
11.3.0 to ≤ 11.3.0affected11.2.0 to ≤ 11.2.2affected10.11.0 to ≤ 10.11.10affected11.4.0unaffected11.3.1unaffected11.2.3unaffected10.11.11unaffected