Mattermost disclosed a bug submitted by c0rydoras: https://hackerone.com/reports/2541027 – Bounty: $150 [Source]