~ / search / GHSA-fmqf-pmcm-8cx9

GHSA-fmqf-pmcm-8cx9

Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-13767

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20251121122154-b57c297c6d7 8.0.0-20251121122154-b57c297c6d7
Go github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.8 10.11.8
Go github.com/mattermost/mattermost-server >= 10.12.0, < 10.12.4 10.12.4
Go github.com/mattermost/mattermost-server >= 11.0.0, < 11.0.6 11.0.6
Go github.com/mattermost/mattermost-server >= 11.1.0, < 11.1.1 11.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.

References

External links from the advisory. They lead to third-party sites.