Zitat von MITs Forum am 29. Mai 2023, 0:00 Uhr

Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link.

References
https://mattermost.com/security-updates/