CVE-2026-22892 json
Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments
published 2026-02-13 8 mo ago modified 2026-06-17 4 mo ago also GHSA-9pj7-jh2r-87g8 , GO-2026-4496 , EUVD-2026-7377
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to via the /create-issue API endpoint by providing the post ID of an inaccessible post.. Mattermost Advisory ID: MMSA-2025-00550
Patch / fix
- go github.com/mattermost/mattermost-server 10.11.10, 10.11.10+incompatible, 11.1.3, 11.1.3+incompatible, 11.2.2, 11.2.2+incompatible
- Mattermost Mattermost 10.11.10, 11.1.3, 11.2.2, 11.3.0
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20260226T182644-150000.1.149.1
suse advisories SUSE-SU-2026:0757-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost-server | >=11.2.0, <11.2.2 >=11.1.0, <11.1.3 >=10.11.0, <10.11.10 >=10.11.0+incompatible, <10.11.10+incompatible >=11.1.0+incompatible, <11.1.3+incompatible >=11.2.0+incompatible, <11.2.2+incompatible |
11.2.2 11.1.3 10.11.10 10.11.10+incompatible 11.1.3+incompatible 11.2.2+incompatible |
Affected products
- Mattermost Mattermost
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
mattermost.com
/security-updates
vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-22892
advisory
-
github.com
/mattermost/mattermost
package
-
github.com
/advisories/GHSA-9pj7-jh2r-87g8
advisory
Sources
- CVE List CVE-2026-22892
- GitHub Advisory GHSA-9pj7-jh2r-87g8
- NVD CVE-2026-22892
- OSV GO-2026-4496
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.