CVE-2026-22892
📋 TL;DR
This vulnerability allows authenticated Mattermost users with Jira plugin access to bypass channel permissions and read posts/attachments from channels they shouldn't have access to. Attackers can exploit the /create-issue API endpoint by providing post IDs of inaccessible posts. Affected organizations are those running vulnerable Mattermost versions with Jira integration enabled.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Sensitive information from private channels is exfiltrated, leading to data breaches, intellectual property theft, or regulatory compliance violations.
Likely Case
Unauthorized access to confidential discussions or files in restricted channels, potentially exposing internal communications or sensitive project details.
If Mitigated
Limited exposure due to proper access controls, monitoring, and quick patching, with minimal data leakage.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of target post IDs; no public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.1.3, 10.11.10, 11.2.2 or later
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost instance. 2. Upgrade to Mattermost version 11.1.3, 10.11.10, 11.2.2 or later. 3. Restart the Mattermost service. 4. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable Jira Plugin
allTemporarily disable the Jira plugin to prevent exploitation until patching is complete.
mmctl plugin disable com.mattermost.plugin-jira
Restrict Jira Plugin Access
allLimit Jira plugin permissions to only trusted users who absolutely need it.
🧯 If You Can't Patch
- Implement strict access controls and monitor for unusual API calls to /create-issue endpoint.
- Disable Jira plugin entirely if not essential for business operations.
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About or run: mattermost versionCheck Version:
mattermost versionVerify Fix Applied:
Confirm version is 11.1.3, 10.11.10, 11.2.2 or later and test Jira issue creation with unauthorized post IDs.📡 Detection & Monitoring
Log Indicators:
- Unusual /create-issue API calls from users accessing posts outside their normal channels
- Failed permission checks in Mattermost logs
Network Indicators:
- HTTP POST requests to /plugins/com.mattermost.plugin-jira/create-issue with unexpected post IDs
SIEM Query:
source="mattermost" AND (uri_path="/plugins/com.mattermost.plugin-jira/create-issue" AND user NOT IN allowed_users)