Mattermost disclosed a bug submitted by vultza: https://hackerone.com/reports/1685979 – Bounty: $300 [Source]