The vulnerability results from missing API‑level permission checks in Mattermost plugins, allowing an authenticated user who belongs to multiple groups to create issues in a group that is configured as locked. This flaw does not enable code execution or privilege escalation beyond the user’s own group memberships, but it permits unauthorized content creation in protected groups, potentially disrupting collaboration and violating group isolation policies.

Mattermost plugins with versions up to 11.5, 11.1.5, 10.13.11, and 11.3.4.0 are vulnerable. Any Mattermost installation running these plugin versions may allow an attacker to create issues in locked groups via the REST API.

The CVSS score of 4.3 indicates a moderate impact. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation is unknown but potentially low to moderate. The attack vector is directly through the API; an attacker only needs an authenticated account that is a member of more than one group. No elevated privileges or remote code execution are required, but the flaw permits bypassing intended group restrictions.