Cloudanix VulnDB

CVE-2026-22892

Medium · 4.3

CVSS

4.3

EPSS

0.3%

Published

Feb 13, 2026

CISA due date

—

The record

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to via the /create-issue API endpoint by providing the post ID of an inaccessible post.. Mattermost Advisory ID: MMSA-2025-00550

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/mattermost/mattermost-server 10.11.0 10.11.10
Go github.com/mattermost/mattermost-server 10.11.0+incompatible 10.11.10+incompatible
Go github.com/mattermost/mattermost-server 11.1.0 11.1.3
Go github.com/mattermost/mattermost-server 11.2.0 11.2.2
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260226T182644-150000.1.149.1

Related vulnerabilities