{"id":"CVE-2026-18560","kind":"vulnerability","aliases":["CVE-2026-18560"],"related":[],"title":"Mattermost: permission check order lets users infer flagged posts","description":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754","summary":"Mattermost versions 11.7.x through 11.10.0 check other conditions before verifying the caller's permissions on a flagged-post lookup. A non-content-reviewer can call the API directly and learn whether a given post has been flagged.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mattermost","package","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"- Run the Mattermost server version check in the admin console or `mattermost version` and compare against the affected ranges\n- Confirm whether content flagging is enabled in the System Console under Compliance or Content Flagging settings","fix":"- Upgrade Mattermost server to a release that includes the MMSA-2026-00754 fix for your release line (11.7.10 or later on 11.7, 11.8.6 or later on 11.8, 11.9.2 or later on 11.9, 11.10.1 or later on 11.10); exact fixed versions unknown from the sources","status":"open","published_at":"2026-10-16T08:17:12+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:41:09+00:00","updated_at":"2026-10-25T04:41:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:41:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mattermost server to a release that includes the MMSA-2026-00754 fix for your release line (11.7.10 or later on 11.7, 11.8.6 or later on 11.8, 11.9.2 or later on 11.9, 11.10.1 or later on 11.10); exact fixed versions unknown from the sources","reach":"internet","title":"Mattermost: permission check order lets users infer flagged posts","impact":"low","summary":"Mattermost versions 11.7.x through 11.10.0 check other conditions before verifying the caller's permissions on a flagged-post lookup. A non-content-reviewer can call the API directly and learn whether a given post has been flagged.","category":"package","nicknames":[],"who_cares":["mattermost","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Any logged-in user learns which posts are flagged for review","analyst_note":"Confirm the exact fixed versions and whether content flagging must be enabled to be exposed, from the Mattermost advisory MMSA-2026-00754.","how_to_check":"- Run the Mattermost server version check in the admin console or `mattermost version` and compare against the affected ranges\n- Confirm whether content flagging is enabled in the System Console under Compliance or Content Flagging settings","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Self-hosted Mattermost servers on the affected 11.x releases are exposed, since any logged-in user can reach the API endpoint. Teams on managed hosting should confirm the provider's patch level. Deployments with content flagging unused have less reason to worry, but the fix is still a version bump.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000648,"input_tokens":3388,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-00754':107C '-18560':12A,15A '-2026':11A,14A,106C '..':101C '11.10':63C '11.10.0':26B,65C '11.7':23B,66C '11.7.9':68C '11.8':72C '11.8.5':74C '11.9':69C '11.9.1':71C 'advisori':103C 'allow':85C 'api':50B,99C 'call':48B,100C 'caller':33B 'check':3A,27B 'condit':29B 'content':45B,88C 'cve':10A,13A 'direct':51B,98C 'fail':75C 'flag':8A,39B,60B,95C 'flagged-post':38B 'given':56B 'host':20B 'id':104C 'infer':7A,91C 'learn':53B 'let':5A 'lookup':41B 'mattermost':1A,16B,21B,61C,102C 'mmsa':105C 'non':44B,87C 'non-cont':86C 'non-content-review':43B 'order':4A 'packag':17B 'permiss':2A,35B,80C 'post':9A,40B,57B,93C 'review':46B,89C 'self':19B 'self-host':18B 'status':96C 'user':6A,78C 'valid':77C,83C 'verifi':31B 'version':22B,62C 'via':97C 'whether':54B 'x':24B,64C,67C,70C,73C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Mattermost servers on the affected 11.x releases are exposed, since any logged-in user can reach the API endpoint. Teams on managed hosting should confirm the provider's patch level. Deployments with content flagging unused have less reason to worry, but the fix is still a version bump.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T08:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"responsibledisclosure@mattermost.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18560","severity":null,"published_at":"2026-10-16T08:17:12+00:00","modified_at":"2026-10-16T19:23:18+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}