Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsolereadplugins permission via creating a post with the customplnotification type and specific props.
{ "nvd_published_at": "2025-01-09T07:15:28Z", "cwe_ids": [ "CWE-1287" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-01-09T18:14:03Z" }