The vulnerability causes the burn‑on‑read reveal endpoint to ignore the X-Requested-With request header. An authenticated member of the channel can embed a malicious Markdown image tag that triggers the endpoint, forcing the message to be revealed to the actor without the original recipient’s consent. The attacker obtains the full message contents that were otherwise hidden, which is a direct confidentiality breach for the channel members.

Mattermost, versions 11.5.x up to 11.5.1 and 11.4.x up to 11.4.3 are affected. Upgrading to 11.6.0, 11.5.2, or 11.4.4 and later removes the flaw.

The CVSS score of 4.3 indicates moderate severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, so while exploitation likelihood is not quantified, the vulnerability can be abused by any authorized channel member. The required conditions are user authentication, channel membership, and the presence of a burn‑on‑read message; the attacker crafts a Markdown image tag to trigger the endpoint. The attack vector is remote, client‑side, and requires no elevated privileges beyond ordinary channel membership.