This vulnerability arises from a missing authorization check on the server side that allows any authenticated user to quarantine a direct message or group message via a direct API call. The flaw exposes a level of privilege escalation, permitting a user to hide or delete messages in private conversations that they do not own, which can be used to manipulate discussions or conceal information. It corresponds to CWE-862, which addresses missing authorization controls.

Mattermost is the affected product. Versions up to and including 11.10.0, 11.7.9, 11.9.1, and 11.8.5 are affected. Any installs of these releases in this range that are not patched remain vulnerable.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of <1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no documented exploitation yet. The attack vector is likely an authenticated internal API call, meaning any user who can log in can trigger the illicit quarantine. Because the flaw is purely an authorization bypass and does not require elevated privileges or privileged roles, the risk to organizations deploying these impacted versions is considered moderate, especially if users have broad permissions over private chats.