CVE-2025-64641
Improper Authorization in Mattermost Jira Plugin Enables Data Exfiltration
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mattermost | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in certain versions of Mattermost where the system fails to verify that post actions invoking the /share-issue-publicly endpoint were actually created by the Jira plugin. This flaw allows a malicious Mattermost user to exfiltrate Jira tickets when other users interact with the affected posts.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of Jira tickets, as a malicious user can trick other users into interacting with posts that exfiltrate sensitive Jira ticket information. This could result in leakage of potentially confidential or sensitive project data.