Kennyski

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 11.8.0 through 11.8.3 **Description** The access control policy unassign endpoint fails to re-validate if a target channel still belongs to the requesting administrator's team. This allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team. ABAC is a method of granting access based on attributes of the user, the resource, and the environment. **Recommendations** Update Mattermost versions 11.7.0 through 11.7.6 to a version newer than 11.7.6. Update Mattermost versions 11.8.0 through 11.8.3 to a version newer than 11.8.3.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 10.11.0 through 10.11.21 **Description** Failure to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions allows an OAuth application possessing a delegated user token to revoke the user's authorizations or tokens for other integrations through account-management endpoints. **Recommendations** Update Mattermost versions 11.7.0 through 11.7.6 to a version newer than 11.7.6. Update Mattermost versions 10.11.0 through 10.11.21 to a version newer than 10.11.21.