Mattermost Channel Membership Validation Vulnerability in Jira Plugin Allowing Unauthorized Post Access

A vulnerability exists in Mattermost versions 11.1.x through 11.1.0, 11.0.x through 11.0.5, 10.12.x through 10.12.3, and 10.11.x through 10.11.7. The issue arises because the application fails to properly validate user channel membership when posts are attached as comments to Jira issues. This flaw enables an authenticated attacker with access to the Jira plugin to read post content and attachments from channels to which they do not have access.

Impact

Exploitation of this vulnerability allows unauthorized access to channel posts and attachments, bypassing channel membership restrictions.

Remediation

Users can upgrade to Mattermost versions 11.2.0, 11.1.0, 10.12.4, or 10.11.8 to address this vulnerability.