Mattermost Access Control Vulnerability in Team Endpoints for System Manager Roles

A vulnerability exists in Mattermost versions 10.7.x through 10.7.0, 10.5.x through 10.5.3, and 9.11.x through 9.11.12. The issue arises from improper enforcement of access control for System Manager roles, allowing authenticated users with these privileges to access team details via direct API requests to team endpoints. This access is granted even when teams are explicitly configured with 'No access' in the System Console.

Impact

Exploitation of this vulnerability allows unauthorized access to team details, bypassing configured access restrictions for users with System Manager roles.