GitHub Advisoryadvisory · Go

GHSA-vww6-79rv-3j4x Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin

MEDIUM Published 2025-12-24 Modified 2026-02-27 Official page ↗
Aliases
CVE-2025-64641
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2025-12-26

Affected packages

• Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20251121122154-b57c297c6d7 → fixed in 8.0.0-20251121122154-b57c297c6d7 • Go github.com/mattermost/mattermost-server: >= 10.11.0, < 10.11.8 → fixed in 10.11.8 • Go github.com/mattermost/mattermost-server: >= 10.12.0, < 10.12.4 → fixed in 10.12.4 • Go github.com/mattermost/mattermost-server: >= 11.0.0, < 11.0.6 → fixed in 11.0.6 • Go github.com/mattermost/mattermost-server: >= 11.1.0, < 11.1.1 → fixed in 11.1.1

Description

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts

Related

Alias · CVE (1)

  • CVE-2025-64641 Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References