CVE-2025-64641 - Mattermost Jira plugin crafted action leaks Jira issue details

Back Back to CVE browser

MEDIUM

Mattermost Jira plugin crafted action leaks Jira issue details

Published Dec 24, 2025

4.1

MEDIUM

CVSS 3.1

EPSS 0.18%

Description

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts

Affected products

Vendor Mattermost Product Mattermost Default
unaffected
- Version
  10.11.0
  Status
  affected
  Constraints
  <=10.11.7
- Version
  10.12.0
  Status
  affected
  Constraints
  <=10.12.3
- Version
  11.0.0
  Status
  affected
  Constraints
  <=11.0.5
- Version
  11.1.0
  Status
  affected
  Constraints
  <=11.1.0
- Version
  10.11.8
  Status
  unaffected
  Constraints
  -
- Version
  10.12.4
  Status
  unaffected
  Constraints
  -
- Version
  11.0.6
  Status
  unaffected
  Constraints
  -
- Version
  11.1.1
  Status
  unaffected
  Constraints
  -
- Version
  11.2.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mattermost

unaffected

Version	Status	Constraints
10.11.0	affected	<=10.11.7
10.12.0	affected	<=10.12.3
11.0.0	affected	<=11.0.5
11.1.0	affected	<=11.1.0
10.11.8	unaffected	-
10.12.4	unaffected	-
11.0.6	unaffected	-
11.1.1	unaffected	-
11.2.0	unaffected	-

github.com/mattermost/mattermost-server/v5

Go

Introduced 0 Fixed not fixed
github.com/mattermost/mattermost-server/v6

Go

Introduced 0 Fixed not fixed
github.com/mattermost/mattermost-server

Go

Introduced 11.1.0+incompatible Fixed 11.1.1+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 10.11.0+incompatible Fixed 10.11.8+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 10.12.0+incompatible Fixed 10.12.4+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 11.0.1+incompatible Fixed 11.0.6+incompatible
github.com/mattermost/mattermost/server/v8

Go

Introduced 0 Fixed not fixed

Ecosystem	Package	Introduced	Fixed
Go	github.com/mattermost/mattermost-server/v5	0	not fixed
Go	github.com/mattermost/mattermost-server/v6	0	not fixed
Go	github.com/mattermost/mattermost-server	11.1.0+incompatible	11.1.1+incompatible
Go	github.com/mattermost/mattermost-server	10.11.0+incompatible	10.11.8+incompatible
Go	github.com/mattermost/mattermost-server	10.12.0+incompatible	10.12.4+incompatible
Go	github.com/mattermost/mattermost-server	11.0.1+incompatible	11.0.6+incompatible
Go	github.com/mattermost/mattermost/server/v8	0	not fixed

Remediation

Vendor solution

Update Mattermost to versions 11.2.0, 11.1.1, 11.0.6, 10.12.4, 10.11.8 or higher.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (7)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-205062		Advisory
https://github.com/advisories/GHSA-vww6-79rv-3j4x		Advisory
https://github.com/mattermost/mattermost/commit/b57c297c6d7ae6812d85e32a625806ac9555deee
https://github.com/mattermost/mattermost/pull/34551
https://mattermost.com/security-updates		vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-64641
https://pkg.go.dev/vuln/GO-2026-4260