CVE-2026-18560

The record

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754

Affected packages

Related vulnerabilities

• CVE-2026-65626 The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a… CWE-203
• CVE-2026-76406 In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted… CWE-203
• CVE-2026-114064 Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook… CWE-203
• CVE-2026-111933 Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before… CWE-203
• CVE-2026-97782 Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to… CWE-203
• CVE-2026-88834 A flaw was found in BusyBox's httpd web server. CWE-203
• CVE-2026-63573 Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap… CWE-203
• CVE-2026-63567 Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. CWE-203