User Permission Validation Flaw in Mattermost Reveals Sensitive Data to Unauthorized Users

CVE-2026-22892

What is CVE-2026-22892?

Certain versions of Mattermost exhibit a vulnerability where they fail to properly validate user permissions when creating Jira issues from Mattermost posts. This oversight allows authenticated attackers, who have access to the Jira plugin, to exploit the /create-issue API endpoint. By providing the post ID of a post they do not have permission to view, these attackers can access sensitive content and attachments from channels that should remain restricted, thereby compromising the confidentiality of the posts. For more details, refer to the Mattermost Advisory ID: MMSA-2025-00550.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References