Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events

Mattermost does not strip embeds from metadata when broadcasting posted events. This allows users to include arbitrary embeds in posts, which are then broadcasted via websockets. This can be exploited in many ways, for example to create permalinks with fully customizable content or to trigger a...

pkg.go.dev Open Redirect vulnerability OBB-2348710

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...