Vulnerability in Mattermost's Jira Plugin Allows Unauthenticated Access

CVE-2025-64641

What is CVE-2025-64641?

Certain versions of Mattermost fail to properly verify that actions initiated through the /share-issue-publicly endpoint are legitimate and originate from the Jira plugin. This oversight allows a malicious user to craft posts that, when interacted with by other users, can result in unauthorized exfiltration of Jira tickets. This vulnerability highlights a significant security gap in user interactions within Mattermost, allowing for potentially sensitive information to be disclosed without proper authorization.

References