Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to via the /create-issue API endpoint by providing the post ID of an inaccessible post.. Mattermost Advisory ID: MMSA-2025-00550
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
Update Mattermost to versions 11.3.0, 11.1.3, 10.11.10, 11.2.2 or higher.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://mattermost.com/security-updates |
|
History
Fri, 13 Feb 2026 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to via the /create-issue API endpoint by providing the post ID of an inaccessible post.. Mattermost Advisory ID: MMSA-2025-00550 | |
| Title | Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments | |
| Weaknesses | CWE-863 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Mattermost
Published:
Updated: 2026-02-13T10:29:00.943Z
Reserved: 2026-01-15T11:34:00.188Z
Link: CVE-2026-22892
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-02-13T11:16:10.693
Modified: 2026-02-13T14:23:48.007
Link: CVE-2026-22892
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses