Description
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to via the /create-issue API endpoint by providing the post ID of an inaccessible post.. Mattermost Advisory ID: MMSA-2025-00550
INFO
Published Date :
2026-02-13T10:29:00.943Z
Last Modified :
2026-02-13T17:03:30.894Z
Source :
Mattermost
AFFECTED PRODUCTS
The following products are affected by CVE-2026-22892 vulnerability.
| Vendors | Products |
|---|---|
| Mattermost |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-22892.
| URL | Resource |
|---|---|
| https://mattermost.com/security-updates |
|
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact