GCVE - cpe:2.3:a:mattermost:mattermost_server:10.0.0:rc4:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mattermost:mattermost_server:10.0.0:rc4:*:*:*:*:*:*

part: a version: 10.0.0 update: rc4

Vendor	Mattermost (`ed0788ef-af60-58f1-b6aa-68289d9946dc`)
Product	Mattermost Server (`657bc445-594e-5ca1-a676-4f18538f1c02`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/mattermost/mattermost-server`	purl2cpe	2026-06-01 10:18:19.859504

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-52032`	vulnerable	2026-06-03 14:57:28.868682	Private channel names leaking when Elasticsearch is enabled MEDIUM (4.3) Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elasticsearch v8 was enabled. Published: 2024-11-09T17:19:35.639Z Updated: 2024-11-12T14:52:07.690Z Open on db.gcve.eu Reference links https://mattermost.com/security-updates	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-42000`	vulnerable	2026-06-03 14:56:35.692074	Unauthorized Access to view channels' details LOW (2.7) Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels. Published: 2024-11-09T17:17:25.038Z Updated: 2024-11-12T14:53:08.813Z Open on db.gcve.eu Reference links https://mattermost.com/security-updates	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.