0x7oda7123

Insufficient permission validation on cross-team playbook run creation

Mattermost schemes teams endpoint exposes private team invite IDs

Mattermost fails to scope role_updated websocket events to authorized team and channel members

*Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings*

Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks

Mattermost fails to enforce create_post permission when editing posts

Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update

Permission Bypass in Playbook Run Creation

Guest users can bypass read permissions via search API

Unauthorized channel enumeration in private teams after member removal