The Mattermost GitLab plugin does not verify channel permissions when handling API requests that include a caller‑supplied post_id, and it fails to validate the web_url parameter against the configured GitLab instance. This shortfall, identified as a Missing Authorization weakness (CWE‑862), permits an authenticated user to inject bot‑authored messages containing arbitrary URLs into Mattermost channels they would normally be unable to post in, enabling phishing or other social engineering attacks.

The vulnerability affects Mattermost GitLab plugin versions up to and including 11.8, 10.20.11, and 11.5.7.0. The issue is resolved in newer releases: 11.9.0 or later for the 11.x branch, 10.11.21 or later for the 10.x branch, and 11.7.6 or later for the 11.x branch. The affected product is the Mattermost GitLab plugin for the Mattermost platform.

The CVSS score of 3.9 indicates moderate severity. The flaw is exploitable only by an authenticated attacker, and the vulnerability is not listed in the CISA KEV catalog. EPSS data is not available, so a precise exploitation probability is not stated. The attack vector involves the createIssue and attachCommentToIssue API endpoints, which accept user‑provided post_id and web_url values and allow injection of messages into channels bypassing normal posting permissions.