Edgar Bellot Micó

Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads

Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost

Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors

User Manager can demote bot accounts to guest without bot-management permission

Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets

Sensitive credentials exposed in plaintext in Mattermost support packets

Race Condition in Guest Magic Link Authentication Allows Token Reuse