Mattermost Server CVE-2025-13767

Exploitation requires an authenticated Mattermost account AND an enabled/configured Jira integration plugin to which the attacker has access, plus the ability to attach Mattermost posts as comments to Jira issues - the feature where channel membership is not validated. The attacker gains read access to post content and attachments from channels they are not a member of. Limiting factors: the Jira plugin must be installed and enabled (not a default-everywhere configuration), the attacker must hold valid credentials (PR:L, so not anonymous/remote-unauthenticated), impact is confined to confidentiality of posts routed through the Jira-comment feature, and only the listed vulnerable version ranges (11.1.x ≤ 11.1.0, 11.0.x ≤ 11.0.5, 10.12.x ≤ 10.12.3, 10.11.x ≤ 10.11.7) are affected.

This is a genuinely moderate-severity authorization flaw, not an inflated high-CVSS issue - the CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects limited real-world risk: network-reachable and low-complexity, but requiring an authenticated account and yielding only low confidentiality impact with no integrity or availability effect. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation probability signals are absent rather than low. The limiting factor not captured by the raw score is that the Jira integration plugin must be installed and enabled and the attacker must already have access to it, which narrows the exploitable population to organizations using that specific integration. Net: a real but bounded data-confidentiality concern (CWE-863 broken access control) best prioritized as routine patching rather than emergency response, absent any exploitation telemetry.

A low-privileged but authenticated Mattermost user who has access to the Jira plugin attaches Mattermost posts as comments to a Jira issue; because channel membership is not validated, they can reference and read post content and attachments from private channels they are not a member of. No public exploit code was identified, and exploitation requires a valid account plus an enabled Jira integration.