An issue exists where user-controlled message fields are rendered as templates without proper neutralization, leading to server-side template injection. An authenticated attacker with a common operational role can inject template expressions that the server evaluates in an unrestricted context.