PT-2025-52646 · Mattermost · Mattermost Jira Plugin+1

Juho Forsén · Published 2025-12-22 · Updated 2026-01-17 · CVE-2025-14273

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.1.x through 11.1.0 Mattermost versions 11.0.x through 11.0.5 Mattermost versions 10.12.x through 10.12.3 Mattermost versions 10.11.x through 10.11.7 Mattermost Jira plugin versions 4.4.0 and earlier

Description The Mattermost Jira plugin does not properly enforce authentication and issue-key path restrictions. This allows an unauthenticated attacker, knowing a valid user ID, to send authenticated GET and POST requests to the Jira server using specially crafted plugin payloads. These payloads can spoof the user ID and inject arbitrary issue key paths. The vulnerability requires the Jira plugin to be enabled.

Recommendations Update Mattermost to a version later than 11.1.0. Update Mattermost to a version later than 11.0.5. Update Mattermost to a version later than 10.12.3. Update Mattermost to a version later than 10.11.7. Update the Mattermost Jira plugin to a version later than 4.4.0.

Fix

Weakness Enumeration

CWE-303

Related Identifiers

CVE-2025-14273

GHSA-QVMC-92VG-6R35

GO-2026-4275

SUSE-SU-2026:0142-1

Affected Products

Mattermost

Mattermost Jira Plugin

References · 51

• https://nvd.nist.gov/vuln/detail/CVE-2025-14273 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14273 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4275 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qvmc-92vg-6r35 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0142-1 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/463e0d0d3930782d3c975da26c991dcbfccd751c · Note
• https://github.com/mattermost/mattermost/commit/317025c411ec8c34381fdd4f137a17c63895a4f2 · Note
• https://github.com/mattermost/mattermost/commit/92b1e705225d97ce54d9f720f2e7aa66dc2a086b · Note
• https://github.com/mattermost/mattermost/commit/7c36acb68ce3c69defaea540623f794c84ecba93 · Note
• https://github.com/mattermost/mattermost/commit/b57c297c6d7ae6812d85e32a625806ac9555deee · Note
• https://github.com/mattermost/mattermost-plugin-jira/commit/bf9a1b7e81eb83304056b397c6abab3b062e14a2 · Note
• https://suse.com/security/cve/CVE-2026-22688 · Note
• https://suse.com/security/cve/CVE-2026-21859 · Note