← All credits

Thanks to Rohitesh Gupta for contributing to this improvement under the Mattermost responsible disclosure policy.

5 vulnerability records and advisories credit this contributor.

Sysadmin can override existing configs & bypass restrictions like EnableUploads

A specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of Service

Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents

Authorized users are allowed to install old plugin versions from the Marketplace

Playbook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.