Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel (CVE-2026-3433) | HOL Guard CVE