CVE-2024-41926

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.5.x through 9.5.6 Mattermost versions 9.9.x through 9.9.0

Description The issue allows a malicious remote to set arbitrary RemoteId values for synced users, which can lead to claiming that a user was synced from another remote. This is due to the failure to validate the source of sync messages.

Recommendations For Mattermost versions 9.5.x through 9.5.6, update to a version that includes the fix for this issue. For Mattermost versions 9.9.x through 9.9.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the sync functionality to minimize the risk of exploitation.