CVE-2024-10241

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.5.x through 9.5.9

Description The issue arises when ElasticSearch is enabled, and Mattermost fails to properly filter channel data. This allows a user to obtain private channel names by using the cmd+K/ctrl+K shortcut.

Recommendations For Mattermost versions 9.5.x through 9.5.9, update to the latest version to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to ElasticSearch or disabling the feature until a patch is available.