CVE-2026-18560 Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "11.10.0",
        "status": "affected",
        "version": "11.10.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "11.7.9",
        "status": "affected",
        "version": "11.7.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "11.9.1",
        "status": "affected",
        "version": "11.9.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "11.8.5",
        "status": "affected",
        "version": "11.8.0",
        "versionType": "semver"
      },
      {
        "version": "11.11.0",
        "status": "unaffected"
      },
      {
        "version": "11.10.1",
        "status": "unaffected"
      },
      {
        "version": "11.7.10",
        "status": "unaffected"
      },
      {
        "version": "11.9.2",
        "status": "unaffected"
      },
      {
        "version": "11.8.6",
        "status": "unaffected"
      }
    ]
  }
]