CVE-2026-22892

Description

Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts in github.com/mattermost/mattermost-server

Affected packages (2)

• Go/github.com/mattermost/mattermost-server>= 11.2.0, < 11.2.2
• Go/github.com/mattermost/mattermost-server>= 10.11.0+incompatible, < 10.11.10+incompatible, >= 11.1.0+incompatible, < 11.1.3+incompatible, >= 11.2.0+incompatible, < 11.2.2+incompatible

CVSS scores

References (4)

• ADVISORYhttps://github.com/advisories/GHSA-9pj7-jh2r-87g8
• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-22892
• PATCHhttps://github.com/mattermost/mattermost
• WEBhttps://mattermost.com/security-updates