Mattermost Server CVE-2025-14273

Exploitation requires that the target Mattermost server run an affected version (11.1.x <=11.1.0, 11.0.x <=11.0.5, 10.12.x <=10.12.3, 10.11.x <=10.11.7) with the Jira plugin BOTH installed AND enabled, and that the Jira plugin be version <=4.4.0 connected to a Jira server. The decisive non-default prerequisite is that the attacker must know a valid Mattermost user ID to spoof in the crafted plugin payload - exploitation is not possible without a usable user ID, so user-ID predictability/enumerability is the practical limiting factor. No end-user interaction and no attacker authentication to Mattermost are required per the CVSS vector (PR:N/UI:N), but the Jira-plugin dependency means default Mattermost installs without the Jira integration are not exposed.

This is a genuine but mid-tier priority, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, and the scope change (S:C) plus low CIA impacts (C:L/I:L/A:L) yield the 8.3 'High' score precisely because the vulnerable Mattermost plugin lets an attacker pivot into a separate security authority - the connected Jira server. However, the exploitation-probability signals push strongly against treating this as broadly weaponizable: EPSS is only 0.26% (17th percentile), there is no CISA KEV listing (confirmed actively exploited status does NOT apply), and no public exploit code was identified at time of analysis. A key tension to flag explicitly: although the CVSS marks PR:N (unauthenticated), the description states the attacker must know a valid user ID to spoof - this is a real-world prerequisite the base score does not capture, so true 'anonymous-off-the-internet' exploitation depends on user-ID enumerability. The CWE is also worth noting: NVD/Mattermost classify this as CWE-303 (incorrect authentication implementation), while one input tag labels it 'Code Injection' - the actual mechanism is an authentication/authorization bypass combined with issue-key path injection, not classic code execution. Net: a real, patch-worthy flaw for anyone running the Jira plugin, but current telemetry suggests limited/targeted rather than mass exploitation.

An attacker who has learned or enumerated a valid Mattermost user ID sends crafted Jira-plugin payloads to a Mattermost server (versions listed, Jira plugin <=4.4.0, plugin enabled) that spoof that user ID and inject arbitrary issue-key paths. Because the plugin fails to enforce authentication and path restrictions, the server issues authenticated GET and POST requests to the backing Jira instance on the victim's behalf, letting the attacker read or act on Jira issues as that user. No public proof-of-concept exploit was identified at time of analysis, and the low EPSS/absence of KEV suggests it is not yet broadly exploited.