CVE-2025-64641

MEDIUM EPSS 4.3%
Published Dec 24, 20256mo ago · Modified Jun 17, 20262w ago
4.1 CVSS 3.1
Medium
Find Similar
Published Dec 24, 2025 6mo ago
Last Modified Jun 17, 2026 2w ago

Description

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts

CVSS Details

Base Score
4.1
Exploitability
2.3
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
4.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-863 Incorrect Authorization Authorization

Affected Products 4

VendorProductVersionRange
mattermostmattermost_server*≥10.11.0  –  <10.11.8
mattermostmattermost_server*≥10.12.0  –  <10.12.4
mattermostmattermost_server*≥11.0.0  –  <11.0.6
mattermostmattermost_server*≥11.1.0  –  <11.1.1

References 1

  • mattermost.com https://mattermost.com/security-updates
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.