CVE-2025-13767

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Mattermost versiones 11.1.x hasta la versión 11.1.0 incluida, 11.0.x hasta la versión 11.0.5 incluida, 10.12.x hasta la versión 10.12.3 incluida y 10.11.x hasta la versión 10.11.7 incluida no valida la pertenencia del usuario al canal al adjuntar publicaciones de Mattermost como comentarios en incidencias de Jira, lo que permite a un atacante autenticado con acceso al plugin de Jira leer el contenido de las publicaciones y sus adjuntos de canales a los que no tiene acceso.

Information

Published : 2025-12-24 08:15

Updated : 2026-10-19 22:10

NVD link : CVE-2025-13767

Mitre link : CVE-2025-13767

CVE.ORG link : CVE-2025-13767

JSON object : View

Products Affected

mattermost

mattermost_server

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-13767", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13767", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-24T16:36:10.970492Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "responsibledisclosure@mattermost.com", "affectedData": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "11.1.0", "versionType": "semver", "lessThanOrEqual": "11.1.0"}, {"status": "affected", "version": "11.0.0", "versionType": "semver", "lessThanOrEqual": "11.0.5"}, {"status": "affected", "version": "10.12.0", "versionType": "semver", "lessThanOrEqual": "10.12.3"}, {"status": "affected", "version": "10.11.0", "versionType": "semver", "lessThanOrEqual": "10.11.7"}, {"status": "unaffected", "version": "11.2.0"}, {"status": "unaffected", "version": "11.1.1"}, {"status": "unaffected", "version": "11.0.6"}, {"status": "unaffected", "version": "10.12.4"}, {"status": "unaffected", "version": "10.11.8"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-24T08:15:45.553", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to."}, {"lang": "es", "value": "Mattermost versiones 11.1.x hasta la versi\u00f3n 11.1.0 incluida, 11.0.x hasta la versi\u00f3n 11.0.5 incluida, 10.12.x hasta la versi\u00f3n 10.12.3 incluida y 10.11.x hasta la versi\u00f3n 10.11.7 incluida no valida la pertenencia del usuario al canal al adjuntar publicaciones de Mattermost como comentarios en incidencias de Jira, lo que permite a un atacante autenticado con acceso al plugin de Jira leer el contenido de las publicaciones y sus adjuntos de canales a los que no tiene acceso."}], "lastModified": "2026-10-19T22:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B0477E2-8999-4E1D-9E6B-7A818CB76488", "versionEndExcluding": "10.11.8", "versionStartIncluding": "10.11.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B83EB4C3-5E75-4BD1-94F3-ED29D329E5C4", "versionEndExcluding": "10.12.4", "versionStartIncluding": "10.12.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6EAC2A0-B481-45EA-90AE-F950921DB06A", "versionEndExcluding": "11.0.6", "versionStartIncluding": "11.0.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "387573EC-2596-4529-BD43-054E52D34EC0", "versionEndExcluding": "11.1.1", "versionStartIncluding": "11.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}