4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-13767

CVE-2025-13767: Unauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-13767

CVE-2025-13767:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20251121122154-b57c297c6d7	8.0.0-20251121122154-b57c297c6d7
github.com/mattermost/mattermost-server	go	>= 10.11.0, < 10.11.8	10.11.8
github.com/mattermost/mattermost-server	go	>= 10.12.0, < 10.12.4	10.12.4
github.com/mattermost/mattermost-server	go	>= 11.0.0, < 11.0.6	11.0.6
github.com/mattermost/mattermost-server	go	>= 11.1.0, < 11.1.1	11.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an authenticated user with access to the Jira plugin to read post content from channels they are not a member of. This is due to a missing authorization check in the mattermost-plugin-jira plugin.

The analysis of the commits between the vulnerable version 4.4.0 and the patched version 4.4.1 of the mattermost-plugin-jira plugin revealed that the fix was implemented in commit bf162b7f899f3bcc43e236a131ebe88090de8bdd.

This commit modifies two main functions, AttachCommentToIssue and CreateIssue in server/issue.go, to include a channel membership check using p.client.Channel.GetMember. Before this change, these functions would process requests to attach posts to Jira issues without verifying if the requesting user had access to the channel where the post originated.

The vulnerable functions are main.Plugin.AttachCommentToIssue and main.Plugin.CreateIssue, along with their corresponding HTTP handlers main.Plugin.httpAttachCommentToIssue and main.Plugin.httpCreateIssue, which act as the entry points for the exploitation of this vulnerability.

Vulnerable functions

main.Plugin.httpAttachCommentToIssue

server/issue.go

This HTTP handler receives the request to attach a comment to a Jira issue. It calls the vulnerable `AttachCommentToIssue` function without performing any authorization checks on the user's access to the Mattermost post.

main.Plugin.AttachCommentToIssue

server/issue.go

This function is responsible for attaching a Mattermost post as a comment to a Jira issue. The vulnerability lies in the fact that before the patch, this function did not verify if the user making the request was a member of the channel where the post was located. The patch adds a call to `p.client.Channel.GetMember` to perform this check.

main.Plugin.httpCreateIssue

server/issue.go

This HTTP handler is used to create a Jira issue from a Mattermost post. It calls the `CreateIssue` function, which was also vulnerable. An attacker could use this endpoint to create a Jira issue with content from a post in a channel they don't have access to.

main.Plugin.CreateIssue

server/issue.go

Similar to `AttachCommentToIssue`, the `CreateIssue` function did not validate if the user had access to the channel of the post being used to create the Jira issue. The patch adds the necessary `p.client.Channel.GetMember` check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.