Vulnerability · Published Feb 13, 2026 · Assigned by Mattermost
CVE-2026-22892Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments
Medium 4.3
In plain English
A medium-severity incorrect authorization in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to via the /create-issue API endpoint by providing the post ID of an inaccessible post.. Mattermost Advisory ID: MMSA-2025-00550
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | 11.2.2 | GHSA-9pj7-jh2r-87g8 |
| Go | github.com/mattermost/mattermost-server | 11.1.3 | GHSA-9pj7-jh2r-87g8 |
| Go | github.com/mattermost/mattermost-server | 10.11.10 | GHSA-9pj7-jh2r-87g8 |
| Go | github.com/mattermost/mattermost-server | 10.11.10+incompatible, 11.1.3+incompatible, 11.2.2+incompatible | GO-2026-4496 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 11.1.0 – through 11.1.210.11.0 – through 10.11.911.2.0 – through 11.2.1 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- MMSA-2025-00550 vendor-advisory