daw10

Admin RCE via Malicious Plugin Upload on CI Test Instances

Password Change Bypass via Auth Switch Endpoint

WebSocket Message Spoofing via Permalink Embed Manipulation

Admin RCE via prepackaged plugins by way of misconfigured imports directory

Account takeover on OAuth/OpenID-enabled servers

Account Takeover via Code Exchange Endpoint

User profile update exposes password hash and MFA secrets

Authentication bypass via userID login when email and username login are disabled

Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controls

Mattermost Zoom Plugin channel preference API lacks authorization checks