Mattermost Plugins Namespace Validation Vulnerability Allowing Unrestricted Group Subscriptions

A vulnerability exists in Mattermost Plugins in versions through 11.5, 11.1.5, 10.13.11, and 11.3.4.0, where the plugins fail to properly validate namespaces. This flaw enables plugin users to subscribe to groups that are not whitelisted by creating groups with prefixes that match those of whitelisted groups.

Impact

Exploitation of this vulnerability could lead to unauthorized group subscriptions, potentially allowing users to access or interact with unapproved group content or activities.

Remediation

Users can upgrade to Mattermost Plugins version 11.7 or later to address this vulnerability.