| Package | Affected versions | Patched versions |
|---|---|---|
| mattermost server | = 10.0.0≥ 9.11.0, < 9.11.3 | 9.11.3 |
Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elasticsearch v8 was enabled.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free