CVE-2025-64641: Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin

December 24, 2025 (updated February 27, 2026)

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts

References

github.com/advisories/GHSA-vww6-79rv-3j4x
github.com/mattermost/mattermost
github.com/mattermost/mattermost/commit/b57c297c6d7ae6812d85e32a625806ac9555deee
github.com/mattermost/mattermost/pull/34551
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-64641
pkg.go.dev/vuln/GO-2026-4260

Code Behaviors & Features

Detect and mitigate CVE-2025-64641 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →