Mrhashimamin

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.15 Mattermost versions 10.5.x through 10.5.5 Mattermost versions 10.6.x through 10.6.5 Mattermost versions 10.7.x through 10.7.2 Mattermost version 10.8.0 Description: The issue arises from the improper enforcement of channel member management permissions when adding participants to playbook runs. This allows authenticated users with member-level permissions to bypass system admin restrictions, adding or removing users to/from private channels via the playbook run participants feature. Even when the 'Manage Members' permission has been explicitly removed, this can lead to unauthorized access to sensitive channel content and allow guest users to gain channel management privileges. Recommendations: For Mattermost versions 9.11.x through 9.11.15, update to a version later than 9.11.15 to resolve the issue. For Mattermost versions 10.5.x through 10.5.5, update to a version later than 10.5.5 to resolve the issue. For Mattermost versions 10.6.x through 10.6.5, update to a version later than 10.6.5 to resolve the issue. For Mattermost versions 10.7.x through 10.7.2, update to a version later than 10.7.2 to resolve the issue. For Mattermost version 10.8.0, update to a version later than 10.8.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 9.11.x through 9.11.8 Mattermost versions 10.3.x through 10.3.3 Mattermost versions 10.4.x through 10.4.2 **Description** The issue arises from the failure to enforce channel conversion restrictions. This allows members with permission to convert public channels to private ones to also convert private channels to public, potentially exposing sensitive information. **Recommendations** For versions 9.11.x through 9.11.8, update to a version that enforces channel conversion restrictions. For versions 10.3.x through 10.3.3, update to a version that enforces channel conversion restrictions. For versions 10.4.x through 10.4.2, update to a version that enforces channel conversion restrictions.