Mattermost Team Admin Privilege Escalation Vulnerability in Private Channels

A vulnerability exists in Mattermost versions 9.11.x prior to 9.11.8, where the application fails to require explicit approval before assigning a team admin to a private channel. This oversight allows team admins to join private channels through specially crafted permalink links without the consent of the channel admins.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing a team admin to access private channels without proper approval.