Mattermost Post Edit Time Limit Bypass Vulnerability in Attachment Modification

A vulnerability exists in Mattermost versions 11.5.x through 11.5.1 and 10.11.x through 10.11.13, allowing authenticated users to bypass the PostEditTimeLimit restriction on non-message post fields. This flaw enables users to alter post file attachments, properties, and pin status after the designated edit period has lapsed, using the post patch and update API endpoints.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of post attachments, properties, and pin statuses, potentially disrupting communication and information sharing within Mattermost channels.

Remediation

Users can upgrade to Mattermost versions 11.7.0 or 11.7.0 to address this vulnerability.