Summary

Sending a PATCH request to /api/channels/:channel_id/messages/:message_id allows users to edit the message type of their own messages.

Mitigation

This has been resolved as of commit df19922. You now require the MANAGE_MESSAGES right to perform this action.