daw10

Unbounded zlib decompression in Calls SDP WebSocket messages

Server panic via outgoing webhook responses

Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.

Persistent notification timing attack causing server denial of service

Missing authorization check in AI message rewrite endpoint allows access to private thread content

Instance and webhook GitLab plugin commands were able to be run by non-admin users

Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels

Insufficient token rotation validation in remote cluster invite confirmation

Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access