CVE-2025-13767
Medium · 4.3Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues
CVSS
4.3
EPSS
0.2%
Published
Dec 24, 2025
CISA due date
—
The record
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | 10.11.0 | 10.11.8 |
| Go | github.com/mattermost/mattermost-server | 10.11.0+incompatible | 10.11.8+incompatible |
| Go | github.com/mattermost/mattermost-server | 10.12.0 | 10.12.4 |
| Go | github.com/mattermost/mattermost-server | 11.0.0 | 11.0.6 |
| Go | github.com/mattermost/mattermost-server | 11.1.0 | 11.1.1 |
| Go | github.com/mattermost/mattermost-server/v5 | 0 | No fix |
| Go | github.com/mattermost/mattermost-server/v6 | 0 | No fix |
| Go | github.com/mattermost/mattermost/server/v8 | 0 | No fix |
| Go | github.com/mattermost/mattermost/server/v8 | 0 | 8.0.0-20251121122154-b57c297c6d7 |
| go | github.com/mattermost/mattermost-server | 10.11.0 | 10.11.8 |
| go | github.com/mattermost/mattermost-server | 10.12.0 | 10.12.4 |
| go | github.com/mattermost/mattermost-server | 11.0.0 | 11.0.6 |
| go | github.com/mattermost/mattermost-server | 11.1.0 | 11.1.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2025-4259 Mattermost doesn't validate user channel membership when attaching Mattermost posts as… Same vulnerability
- GO-2026-4305 Mattermost Server vulnerable to CSRF if CORS is enabled in… Also affects github.com/mattermost/mattermost-server
- GO-2026-4326 Mattermost is vulnerable to DoS due to infinite re-renders on API errors in… Also affects github.com/mattermost/mattermost-server
- GO-2025-4260 Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created… Also affects github.com/mattermost/mattermost-server
- GO-2026-4325 Mattermost is vulnerable to CPU exhaustion via crafted HTTP request in… Also affects github.com/mattermost/mattermost-server
- GO-2026-4282 Mattermost Server is vulnerable to channel invisibility DoS via misformatted post in… Also affects github.com/mattermost/mattermost-server
- GO-2026-4496 Mattermost doesn't validate user permissions when creating Jira issues from Mattermost… Also affects github.com/mattermost/mattermost-server
- GO-2026-4520 Mattermost fails to properly validate login method restrictions in… Also affects github.com/mattermost/mattermost-server