Log in Start free

Vulnerability · Published Dec 24, 2025 · Assigned by Mattermost

CVE-2025-64641Mattermost Jira plugin crafted action leaks Jira issue details

Medium 4.1

In plain English

A medium-severity incorrect authorization in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)0.2%top 93.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/mattermost/mattermost-server11.0.6GHSA-vww6-79rv-3j4x
Gogithub.com/mattermost/mattermost-server10.11.8GHSA-vww6-79rv-3j4x
Gogithub.com/mattermost/mattermost-server10.12.4GHSA-vww6-79rv-3j4x
Gogithub.com/mattermost/mattermost-server11.1.1GHSA-vww6-79rv-3j4x
Gogithub.com/mattermost/mattermost-server10.11.8+incompatible, 10.12.4+incompatible, 11.0.6+incompatible, 11.1.1+incompatibleGO-2025-4260
Gogithub.com/mattermost/mattermost-server/v5no fix listedGO-2025-4260
Gogithub.com/mattermost/mattermost-server/v6no fix listedGO-2025-4260
Gogithub.com/mattermost/mattermost/server/v8no fix listedGO-2025-4260
Gogithub.com/mattermost/mattermost/server/v88.0.0-20251121122154-b57c297c6d7GHSA-vww6-79rv-3j4x

Affected products (as reported)

VendorProductVersions
Mattermost Mattermost 11.1.0 – through 11.1.011.0.0 – through 11.0.510.12.0 – through 10.12.310.11.0 – through 10.11.7

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

References