CVE-2025-13767 json
Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin
published 2025-12-24 10 mo ago modified 2026-10-19 20 d ago also GHSA-fmqf-pmcm-8cx9 , GO-2025-4259 , EUVD-2025-205063
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 9%
- public exploits
- 0
- none known
Summary
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.
Patch / fix
- go github.com/mattermost/mattermost/server/v8 8.0.0-20251121122154-b57c297c6d7
- go github.com/mattermost/mattermost-server 10.11.8, 10.11.8+incompatible, 10.12.4, 10.12.4+incompatible, 11.0.6, 11.0.6+incompatible, 11.1.1, 11.1.1+incompatible
- Mattermost Mattermost 10.11.8, 10.12.4, 11.0.6, 11.1.1, 11.2.0
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20260226T182644-150000.1.149.1
suse advisories SUSE-SU-2026:0757-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
- github.com/mattermost/mattermost@b57c297 commit
- github.com/mattermost/mattermost#34551 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
0.19% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20251121122154-b57c297c6d7 all versions |
8.0.0-20251121122154-b57c297c6d7 |
| go | github.com/mattermost/mattermost-server | >=10.11.0, <10.11.8 >=10.12.0, <10.12.4 >=11.0.0, <11.0.6 >=11.1.0, <11.1.1 >=10.11.0+incompatible, <10.11.8+incompatible >=10.12.0+incompatible, <10.12.4+incompatible >=11.0.1+incompatible, <11.0.6+incompatible >=11.1.0+incompatible, <11.1.1+incompatible |
10.11.8 10.12.4 11.0.6 11.1.1 10.11.8+incompatible 10.12.4+incompatible 11.0.6+incompatible 11.1.1+incompatible |
| go | github.com/mattermost/mattermost-server/v5 | all versions |
no fix listed |
| go | github.com/mattermost/mattermost-server/v6 | all versions |
no fix listed |
Affected products
- Mattermost Mattermost
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/mattermost/mattermost/pull/34551
web
-
github.com
/mattermost/mattermost/commit/b57c297c6d7ae6812d85e32a625806ac9555deee
web
-
mattermost.com
/security-updates
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-13767
advisory
-
github.com
/mattermost/mattermost
package
-
pkg.go.dev
/vuln/GO-2026-4259
web
-
github.com
/advisories/GHSA-fmqf-pmcm-8cx9
advisory
Sources
- CVE List CVE-2025-13767
- GitHub Advisory GHSA-fmqf-pmcm-8cx9
- NVD CVE-2025-13767
- OSV GO-2025-4259
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.