PT-2025-52872 · Atlassian+1 · Jira Plugin+1

Juho Forsén

·

Publicado

2025-12-24

·

Atualizado

2026-03-03

·

CVE-2025-13767

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.7 Mattermost versions 10.12.x through 10.12.3 Mattermost versions 11.0.x through 11.0.5 Mattermost versions 11.1.x through 11.1.0
Description The software does not properly validate user channel membership when attaching Mattermost posts as comments to Jira issues. This allows an authenticated attacker who has access to the Jira plugin to read post content and attachments from channels they are not authorized to access.
Recommendations Update Mattermost to a version later than 10.11.7. Update Mattermost to a version later than 10.12.3. Update Mattermost to a version later than 11.0.5. Update Mattermost to a version later than 11.1.0.

Correção

Incorrect Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2025-13767
GHSA-FMQF-PMCM-8CX9
GO-2025-4259
SUSE-SU-2026:0757-1

Produtos afetados

Jira Plugin
Mattermost