Live › vulnerability › CVE-2026-18560
Go to dashboardMattermost versions 11.7.x through 11.10.0 check other conditions before verifying the caller's permissions on a flagged-post lookup. A non-content-reviewer can call the API directly and learn whether a given post has been flagged.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Mattermost servers on the affected 11.x releases are exposed, since any logged-in user can reach the API endpoint. Teams on managed hosting should confirm the provider's patch level. Deployments with content flagging unused have less reason to worry, but the fix is still a version bump.
No product ranges from the sources yet.
mattermost version and compare against the affected rangesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754
This page as .md · .json · in your agent: get_signal("CVE-2026-18560")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.