Kiwi_71

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 10.11.0 through 10.11.20 Mattermost versions 11.7.0 through 11.7.5 **Description** The software fails to remove thread membership records when a user leaves or is removed from a team. This allows a user who is subsequently re-invited to the team to access private channel thread root post content and metadata through the team threads API. **Recommendations** Update Mattermost versions 10.11.0 through 10.11.20 to a version newer than 10.11.20. Update Mattermost versions 11.7.0 through 11.7.5 to a version newer than 11.7.5.