CVE-2018-21254

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1

Description An issue was discovered that allows an attacker to bypass intended access control for direct-message channel creation via the Message slash command.

Recommendations For versions prior to 5.1, update to version 5.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Message slash command until a patch is available.