CVE-2026-18560

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x

CVE-2026-18560 Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754...

CVE-2026-85175

SiYuan versions ≤ 3.8.1 contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go) that only blocks conf/conf.json by exact match but fails to restrict the TLS private key (conf/key.pem) and CA private key (conf/ca.key). Because the getFile handler skips the ...