CVE-2026-22892

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to via the /create-issue API endpoint by providing the post ID of an inaccessible post.. Mattermost Advisory ID: MMSA-2025-00550

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Feb 13, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-228937.2A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administCVE-2026-228946.5A path traversal vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit CVE-2026-228954.8A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator account, tCVE-2026-228966.2A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administratorCVE-2026-228979.8A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to executCVE-2026-228989.8A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the CVE-2026-228996.5A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can theCVE-2026-22903.8The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This CVE-2026-229009.8A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerabiliCVE-2026-229019.8A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit CVE-2026-229026.7A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can thenCVE-2026-229039.8An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buff
CVE-2026-22892: Medium severity, CVSS 4.3 | Vulnix