Mattermost versions 11.3.x through 10.11.x fail to sanitize client-supplied post metadata. An authenticated attacker can send crafted PUT requests to the post update API endpoint to insert or alter permalink embeds, causing messages to appear as if sent by other users. This allows user impersonation and can undermine trust in the collaboration platform. The vulnerability is classified as CWE-346 (Broken Access Control).

Vendors: Mattermost. Product: Mattermost. Affected versions include all releases 11.3.0 and older, 11.2.2 and older, and 10.11.10 and older. An attacker must be authenticated to exploit the vulnerability.

The CVSS score is 4.3, indicating moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access and a crafted HTTP PUT request to the post update API, making it an authenticated remote misuse of the API, rather than a public unauthenticated attack.