GHSA-fmqf-pmcm-8cx9 (CVE-2025-13767)

Details

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.

Affected Packages

Gogithub.com/mattermost/mattermost-server

Fixed in:

10.11.8

Gogithub.com/mattermost/mattermost-server

Fixed in:

10.12.4

Gogithub.com/mattermost/mattermost-server

Fixed in:

11.0.6

Gogithub.com/mattermost/mattermost-server

Fixed in:

11.1.1

Gogithub.com/mattermost/mattermost/server/v8

Fixed in:

8.0.0-20251121122154-b57c297c6d7

References

ADVISORYhttps://github.com/advisories/GHSA-fmqf-pmcm-8cx9 PACKAGEhttps://github.com/mattermost/mattermost WEBhttps://github.com/mattermost/mattermost/commit/b57c297c6d7ae6812d85e32a625806ac9555deee WEBhttps://github.com/mattermost/mattermost/pull/34551 WEBhttps://mattermost.com/security-updates ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-13767

GHSA-fmqf-pmcm-8cx9

Details

Affected Packages

References

Aliases

CVSS Analysis

Related

Ecosystems

Timeline