CVE-2025-64641
Fixed in a distro release EPSS <1%CVSS 4.1
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts
Products: Mattermost
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/mattermost/mattermost-server | 10.11.8 |
| Go | github.com/mattermost/mattermost-server | 10.12.4 |
| Go | github.com/mattermost/mattermost-server | 11.0.6 |
| Go | github.com/mattermost/mattermost-server | 11.1.1 |
| Go | github.com/mattermost/mattermost-server | 10.11.8+incompatible |
| Go | github.com/mattermost/mattermost-server | 10.12.4+incompatible |
| Go | github.com/mattermost/mattermost-server | 11.0.6+incompatible |
| Go | github.com/mattermost/mattermost-server | 11.1.1+incompatible |
| Go | github.com/mattermost/mattermost-server/v5 | no fix |
| Go | github.com/mattermost/mattermost-server/v6 | no fix |
| Go | github.com/mattermost/mattermost/server/v8 | 8.0.0-20251121122154-b57c297c6d7 |
| Go | github.com/mattermost/mattermost/server/v8 | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0.0.20260226T182644-150000.1.149.1 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |