Mattermost server versions 10.11.0 through 10.11.3 and 10.5.0 through 10.5.11, as well as certain earlier versions, contain an authorization vulnerability in the Add Channel Member API. This flaw allows users from one team to improperly access user metadata and channel membership information from other teams. The issue is due to improper validation of team membership permissions. A fix is available in versions 10.11.4, 10.5.12, and specified earlier versions.