Mattermost vulnerabilities

Mattermost fails to verify channel membership when linking a board to a channel, allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to.

Mattermost fails to properly validate the origin of a websocket connection, allowing a MITM attacker to access the websocket APIs.

Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF.