{"id":"EUVD-2025-205063","enisaUuid":"56a8af03-b542-3d3f-b542-59a7ecb11e16","description":"Mattermost versions 11.1.x \u003c\u003d 11.1.0, 11.0.x \u003c\u003d 11.0.5, 10.12.x \u003c\u003d 10.12.3, 10.11.x \u003c\u003d 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.","datePublished":"Dec 24, 2025, 8:01:27 AM","dateUpdated":"Dec 24, 2025, 4:36:22 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-13767\nGHSA-fmqf-pmcm-8cx9\n","assigner":"Mattermost","epss":0.19,"enisaIdProduct":[{"id":"3673145c-2ffd-3ed5-8388-d178995a4b2a","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.1.0 ≤11.1.0"},{"id":"674341ce-e5c8-3fb4-859b-0e4e03714b70","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.0.0 ≤11.0.5"},{"id":"bd77ce72-bbeb-3b27-828e-f3c140e58dff","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.7"},{"id":"f75a8c61-1886-3058-af1c-06780fe4b837","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.12.0 ≤10.12.3"}],"enisaIdVendor":[{"id":"8e3e7ed8-33ef-36a1-93c2-e7ffb5dd5af6","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"8906c33d-77ce-3d9c-abb6-1aabf42795b8","vulnerability":{"id":"GHSA-fmqf-pmcm-8cx9","description":"Mattermost doesn\u0027t validate user channel membership when attaching Mattermost posts as comments to Jira issues","datePublished":"Dec 24, 2025, 9:30:22 AM","dateUpdated":"Feb 27, 2026, 10:04:19 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-13767\nhttps://github.com/mattermost/mattermost/pull/34551\nhttps://github.com/mattermost/mattermost/commit/b57c297c6d7ae6812d85e32a625806ac9555deee\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\nhttps://pkg.go.dev/vuln/GO-2026-4259\n","enisa_id":"EUVD-2025-205063\n","aliases":"GHSA-fmqf-pmcm-8cx9\nCVE-2025-13767\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:52:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e9571d01-1ec2-3087-8be3-8f49d81975ea","vulnerability":{"id":"CVE-2025-13767","description":"Mattermost versions 11.1.x \u003c\u003d 11.1.0, 11.0.x \u003c\u003d 11.0.5, 10.12.x \u003c\u003d 10.12.3, 10.11.x \u003c\u003d 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.","datePublished":"Dec 24, 2025, 8:01:27 AM","dateUpdated":"Dec 24, 2025, 4:36:22 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-205063\n","assigner":"Mattermost","epss":0.19,"dataProcessed":"Oct 27, 2026, 7:17:47 AM","vulnerabilityProduct":[{"id":"38f92375-f7c5-38b8-80cd-b549d20183ef","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.1.0 ≤11.1.0"},{"id":"48ff6688-581b-3cd9-a9ae-02d01bcccdff","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.12.0 ≤10.12.3"},{"id":"55a724a1-4035-378d-9d70-fde09d02f860","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.0.0 ≤11.0.5"},{"id":"c94ad55a-606c-3084-9e6b-cbe72f573cc7","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.7"}],"vulnerabilityVendor":[{"id":"c44204b7-6fcb-33e3-a7a5-c37b27e70f20","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[{"id":"b9175a50-2dc8-3e16-9c73-b296eb821ae6","advisory":{"id":"WID-SEC-W-2025-2712","description":"Mattermost: Schwachstelle ermöglicht Offenlegung von Informationen","summary":"Ein Angreifer kann eine Schwachstelle in Mattermost ausnutzen, um Informationen offenzulegen.","datePublished":"Dec 1, 2025, 11:00:00 PM","dateUpdated":"Feb 26, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2712.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2025-2712\n","aliases":"CVE-2025-13767\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"5f419567-c7e4-30d6-83b3-f68b8ea12756","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}}},{"id":"ad099678-19be-301f-8094-891d03ba3c16","product":{"name":"Server 11.2.0","vendor":{"name":"Mattermost"}}},{"id":"be62500a-9735-3f14-9aec-52f61d40f14a","product":{"name":"Server 11.0.6","vendor":{"name":"Mattermost"}}},{"id":"ccbe71c5-1337-3229-a81b-bf79e07428d3","product":{"name":"Server 11.1.1","vendor":{"name":"Mattermost"}}},{"id":"f07dfd8a-61d2-3b55-8c56-82c08f937294","product":{"name":"Server 10.11.8","vendor":{"name":"Mattermost"}}},{"id":"fea19d7b-35ac-3523-b13d-1f85d38dbc0b","product":{"name":"Server 10.12.4","vendor":{"name":"Mattermost"}}}]}}]}