Versions of Mattermost 11.10.x (≤ 11.10.0), 11.7.x (≤ 11.7.9), 11.9.x (≤ 11.9.1), and 11.8.x (≤ 11.8.5) do not validate a user’s permissions early enough in the GetFile API flow, reflecting a weakness categorized as CWE-203. As a result, any authenticated user who is not a content reviewer can infer whether a post has been quarantined or flagged by observing the API response. This permits disclosure of sensitive status information about content that should remain hidden to most users.

Mattermost Mattermost; affected releases include 11.10.0 and earlier of 11.10.x, 11.7.9 and earlier of 11.7.x, 11.9.1 and earlier of 11.9.x, and 11.8.5 and earlier of 11.8.x.

The CVSS score is 4.3, indicating a moderate level of risk. An exploiter only needs authenticated access to the Mattermost instance and can trigger the API call remotely; no additional privileges or code execution are required. The EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet.