Mr_Anksec

**Name of the Vulnerable Software and Affected Versions** Mattermost versions prior to 11.5.2 Mattermost versions prior to 10.11.14 Mattermost versions prior to 11.4.4 **Description** An issue exists where the system fails to enforce trigger-word uniqueness during the update of slash commands. This allows an authenticated team member with the Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash commands. This is achieved by editing their own slash command trigger to match an already-registered trigger through the command update API. **Recommendations** Update to version 11.5.2 or later. Update to version 10.11.14 or later. Update to version 11.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 6.4.x and earlier **Description** The issue arises from the failure to properly invalidate pending email invitations when the action is performed from the system console. This allows accidentally invited users to join the workspace and access information from public teams and channels. The problem is related to improper control of a resource through its lifetime in Mattermost. **Recommendations** For Mattermost versions 6.4.x and earlier, consider restricting access to public teams and channels until a proper fix is applied to prevent accidentally invited users from accessing sensitive information. As a temporary workaround, manually invalidate pending email invitations to prevent unauthorized access.