Mattermost Server CVE-2025-64641

Requires (1) an authenticated Mattermost user account with the ability to post in a channel shared with victims, (2) the Jira plugin to be installed and in use so that '/share-issue-publicly' post actions are meaningful, and (3) one or more victim users who actually click or interact with the attacker's crafted post. The core flaw is that the server does not verify that a '/share-issue-publicly' post action was created by the Jira plugin, letting any user forge one. Exploitation is limited by the need for valid credentials (PR:L), mandatory victim interaction (UI:R), the presence of the Jira integration, and the fact that only Jira ticket data the victim can access is exposed - not full server compromise.

This is a genuine but low-to-moderate-priority issue, not a high-urgency emergency. The CVSS 3.1 base score is 4.1 (Medium), and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N shows why: exploitation requires an already-authenticated Mattermost user (PR:L), depends on a victim actively interacting with a malicious post (UI:R), and yields only limited confidentiality impact (C:L) with no integrity or availability effect. The scope-changed flag (S:C) reflects that data from a separate system - Jira, via the plugin - is what gets exposed, which is why the impact is scored as crossing a trust boundary. No EPSS score, SSVC decision data, KEV listing, or POC indicator was supplied in the input, so exploitation probability cannot be quantified from this data set. Exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (insider/authenticated-user threat with user-interaction dependence and data-disclosure-only impact), so there is no network-vs-local or auth contradiction to flag; the main missing signals are EPSS and any independent exploitability telemetry. Net assessment: a realistic insider/malicious-tenant data-exfiltration flaw worth patching on a normal cycle, but not a drop-everything network-unauthenticated RCE.

A malicious but authenticated user on a Mattermost server crafts a post containing a forged '/share-issue-publicly' post action that the server does not verify as originating from the legitimate Jira plugin. When a colleague with Jira access clicks or interacts with the post, the action executes under the victim's context and leaks the contents of a Jira ticket back to the attacker. No public exploit code was identified in the provided data, so this scenario is inferred from the description and CVSS vector (authenticated, user-interaction-dependent, confidentiality-only).