Juho Forsén

Malicious remote can create/update/delete arbitrary posts in arbitrary channels

Existing local user overwritten by malicious remote

Malicious remote can add users to arbitrary teams and channels

Malicious remote can make an arbitrary local channel read-only

Timing attack during remote cluster token comparison when shared channels are enabled

Spoofed push notifications from malicious server

RemoteClusterFrame payloads are audit logged in full

Creating posts with user-defined IDs permitted in CreatePost API

Lack of permission check when updating the profile picture of a remote user (shared channels enabled)

Limited DoS due to permitting creating users with user-defined IDs