CVE-2024-42406

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Sep 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-424078.5Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenti CVE-2024-424083.7The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additiona CVE-2024-42418.8A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been declared as critical. This vulnerability affects the function formQosManage CVE-2024-424106.5Improper input validation in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via loca CVE-2024-424115.3Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which CVE-2024-424126.1Cross-site scripting vulnerability exists in ELECOM wireless access points due to improper processing of input values in menu.cgi. If a user CVE-2024-424157.8An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured Fi CVE-2024-424168.8The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limi CVE-2024-424178.8Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to expl CVE-2024-424187.5Avtec Outpost uses a default cryptographic key that can be used to decrypt sensitive information.CVE-2024-424196.7Incorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software installers may allow an authenticated user to potent CVE-2024-42428.8A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been rated as critical. This issue affects the function formwrlSSIDget of the fi