Mattermost server versions 10.11.x up to 10.11.3, 10.5.x up to 10.5.11, and 10.12.x up to 10.12.0 contain a vulnerability where the MSTeams plugin OAuth flow does not properly validate the relationship to the post being updated. This flaw allows an attacker to edit arbitrary posts by crafting a malicious MSTeams plugin OAuth redirect URL. The issue is fixed in versions 10.11.4, 10.5.12, and 10.12.1.