Mattermost Privilege Escalation Vulnerability When Converting Users to Bots

A vulnerability exists in Mattermost versions 9.11.x prior to 9.11.6 and 10.4.x prior to 10.4.1, allowing users to escalate privileges by converting them to bots without invalidating active sessions. This oversight enables the newly converted bot to inherit permissions that could be misused, depending on the bot's granted rights.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing users to gain elevated rights and access within the Mattermost application.

Remediation

Users are advised to upgrade to Mattermost versions 9.11.6 or 10.4.1.