PT-2025-52872 · Atlassian+1 · Jira Plugin+1

Juho Forsén

·

Published

2025-12-24

·

Updated

2026-03-03

·

CVE-2025-13767

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.7 Mattermost versions 10.12.x through 10.12.3 Mattermost versions 11.0.x through 11.0.5 Mattermost versions 11.1.x through 11.1.0
Description The software does not properly validate user channel membership when attaching Mattermost posts as comments to Jira issues. This allows an authenticated attacker who has access to the Jira plugin to read post content and attachments from channels they are not authorized to access.
Recommendations Update Mattermost to a version later than 10.11.7. Update Mattermost to a version later than 10.12.3. Update Mattermost to a version later than 11.0.5. Update Mattermost to a version later than 11.1.0.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-13767
GHSA-FMQF-PMCM-8CX9
GO-2025-4259
SUSE-SU-2026:0757-1

Affected Products

Jira Plugin
Mattermost