Cross-site Request Forgery (CSRF)

Mattermost is vulnerable to Cross-site Request Forgery (CSRF). The vulnerability is due to a failure to validate post actions properly, allowing an attacker to run a playbook checklist task command as another user by creating and sharing a deceptive post action that unexpectedly runs a slash command in an arbitrary channel.