Mattermost Jira Plugin User Permission Vulnerability Allowing Unauthorized Access to Channel Posts

A vulnerability exists in the Mattermost Jira plugin, specifically in versions 11.1.x through 11.1.2, 10.11.x through 10.11.9, and 11.2.x through 11.2.1. The issue arises because the plugin fails to properly validate user permissions when creating Jira issues from Mattermost posts. This flaw enables an authenticated attacker with access to the Jira plugin to use the '/create-issue' API endpoint to read content and attachments from posts in channels they do not have access to, by referencing the post ID of an inaccessible post.

Impact

Exploitation of this vulnerability allows for unauthorized access to channel posts and attachments, bypassing normal permission restrictions.

Remediation

Users can upgrade to Mattermost versions 11.3.0, 10.11.10, or 11.2.2 to address this vulnerability.