CERT PL

Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

Private channel ID disclosure via user status endpoints

Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token

Private team metadata disclosure via the team search API

Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access