Arang

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.7.0 through 11.7.2 Mattermost versions 11.6.0 through 11.6.4 Mattermost versions 10.11.0 through 10.11.19 **Description** An issue exists where the system fails to validate whether an assigned incoming webhook user has the necessary access to the target team or channel. This allows a requester with webhook management permissions to create posts or direct messages attributed to another user by using crafted incoming webhook configurations and payloads. **Recommendations** Update Mattermost versions 11.7.0 through 11.7.2 to a version newer than 11.7.2. Update Mattermost versions 11.6.0 through 11.6.4 to a version newer than 11.6.4. Update Mattermost versions 10.11.0 through 10.11.19 to a version newer than 10.11.19.