CVE-2026-22892

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.9 Mattermost versions 11.1.x through 11.1.2 Mattermost versions 11.2.x through 11.2.1

Description The software does not properly validate user permissions when creating Jira issues from Mattermost posts. This allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they should not have access to. The issue occurs when using the /create-issue API endpoint and providing the post ID of an inaccessible post. The vulnerable parameter is the post ID.

Recommendations Update Mattermost to a version later than 10.11.9. Update Mattermost to a version later than 11.1.2. Update Mattermost to a version later than 11.2.1.