CVE-2025-14273 json
Mattermost Jira plugin user spoofing enables Jira request forgery.
published 2025-12-22 10 mo ago modified 2026-10-14 25 d ago also GHSA-qvmc-92vg-6r35 , GO-2026-4275 , EUVD-2025-204707
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue key paths. Mattermost Advisory ID: MMSA-2025-00555
Patch / fix
- go github.com/mattermost/mattermost/server/v8 8.0.0-20251121122154-b57c297c6d7a
- go github.com/mattermost/mattermost-plugin-jira 4.4.1
- Mattermost Mattermost 10.11.8, 10.12.4, 11.0.6, 11.1.1, 11.2.0
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20260114T191543-150000.1.137.1
suse advisories SUSE-SU-2026:0142-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L |
| NVD | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
| GitHub | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20251121122154-b57c297c6d7a |
8.0.0-20251121122154-b57c297c6d7a |
| go | github.com/mattermost/mattermost-plugin-jira | <4.4.1 all versions |
4.4.1 |
| go | github.com/mattermost/mattermost-server | all versions |
no fix listed |
| go | github.com/mattermost/mattermost-server/v5 | all versions |
no fix listed |
| go | github.com/mattermost/mattermost-server/v6 | all versions |
no fix listed |
Affected products
- Mattermost Mattermost
Classification
- Weakness
-
- CWE-303 Incorrect Implementation of Authentication Algorithm
References
-
github.com
/mattermost/mattermost-plugin-jira/commit/bf9a1b7e81eb83304056b397c6abab3b062e14a2
web, patch
-
github.com
/mattermost/mattermost/commit/317025c411ec8c34381fdd4f137a17c63895a4f2
web
-
github.com
/mattermost/mattermost/commit/463e0d0d3930782d3c975da26c991dcbfccd751c
web
-
github.com
/mattermost/mattermost/commit/7c36acb68ce3c69defaea540623f794c84ecba93
web
-
github.com
/mattermost/mattermost/commit/92b1e705225d97ce54d9f720f2e7aa66dc2a086b
web
-
github.com
/mattermost/mattermost/commit/b57c297c6d7ae6812d85e32a625806ac9555deee
web
-
mattermost.com
/security-updates
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-14273
advisory
-
github.com
/mattermost/mattermost
package
-
github.com
/advisories/GHSA-qvmc-92vg-6r35
advisory
Sources
- CVE List CVE-2025-14273
- GitHub Advisory GHSA-qvmc-92vg-6r35
- NVD CVE-2025-14273
- OSV GO-2026-4275
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.