Threats tagged 'ghsa-jq9q-vph7-fh8w'

Mattermost versions 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, and 11.7.x up to 11.7.10 contain a vulnerability in the Agents plugin's mention reminder component. This flaw allows an authenticated user with posting permissions in a channel visible to a system administrator to craft a post with a forged mention reminder. If the administrator clicks this mention, their browser sends an unintended API request that can replace an installed plugin, leading to remote code execution on the server.