Mattermost disclosed a bug submitted by uchihaluckycs: https://hackerone.com/reports/1888915 – Bounty: $750 [Source]