CVE-2025-64641
Medium · 4.1Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin
CVSS
4.1
EPSS
0.2%
Published
Dec 24, 2025
CISA due date
—
The record
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | 10.11.0 | 10.11.8 |
| Go | github.com/mattermost/mattermost-server | 10.11.0+incompatible | 10.11.8+incompatible |
| Go | github.com/mattermost/mattermost-server | 10.12.0 | 10.12.4 |
| Go | github.com/mattermost/mattermost-server | 11.0.0 | 11.0.6 |
| Go | github.com/mattermost/mattermost-server | 11.1.0 | 11.1.1 |
| Go | github.com/mattermost/mattermost-server/v5 | 0 | No fix |
| Go | github.com/mattermost/mattermost-server/v6 | 0 | No fix |
| Go | github.com/mattermost/mattermost/server/v8 | 0 | No fix |
| Go | github.com/mattermost/mattermost/server/v8 | 0 | 8.0.0-20251121122154-b57c297c6d7 |
| go | github.com/mattermost/mattermost-server | 10.11.0 | 10.11.8 |
| go | github.com/mattermost/mattermost-server | 10.12.0 | 10.12.4 |
| go | github.com/mattermost/mattermost-server | 11.0.0 | 11.0.6 |
| go | github.com/mattermost/mattermost-server | 11.1.0 | 11.1.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2025-4260 Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created… Same vulnerability
- GO-2026-4305 Mattermost Server vulnerable to CSRF if CORS is enabled in… Also affects github.com/mattermost/mattermost-server
- GO-2025-4259 Mattermost doesn't validate user channel membership when attaching Mattermost posts as… Also affects github.com/mattermost/mattermost-server
- GO-2026-4326 Mattermost is vulnerable to DoS due to infinite re-renders on API errors in… Also affects github.com/mattermost/mattermost-server
- GO-2026-4325 Mattermost is vulnerable to CPU exhaustion via crafted HTTP request in… Also affects github.com/mattermost/mattermost-server
- GO-2026-4282 Mattermost Server is vulnerable to channel invisibility DoS via misformatted post in… Also affects github.com/mattermost/mattermost-server
- GO-2026-4496 Mattermost doesn't validate user permissions when creating Jira issues from Mattermost… Also affects github.com/mattermost/mattermost-server
- GO-2026-4520 Mattermost fails to properly validate login method restrictions in… Also affects github.com/mattermost/mattermost-server