Mattermost EUVD-2026-38249

Exploitation requires the target Mattermost instance to have the Atlassian Connect Jira integration feature present and for a privileged user (admin) to have recently initiated a Jira app installation - this is the 'pending-install window' that exposes the /ac/installed endpoint to unauthenticated writes. Outside this window, the practical attack opportunity is significantly reduced, as the endpoint's callback is not expected. The CVSS AC:H metric encodes this timing dependency. UI:R further reflects that a legitimate user action (initiating the install) must precede the attack. The vendor CVSS vector assigns PR:L, but the description states 'remote unauthenticated' - if PR:L is accurate, some form of low-privilege access to the Mattermost network path may also be required; this is not resolved in available data and defenders should treat the auth requirement as unconfirmed. Exploitation is limited to disrupting or hijacking the Jira integration specifically; there is no indicated path to broader system compromise, code execution, or credential theft.

The vendor-assigned CVSS base score of 6.4 (Medium) reflects several mitigating complexity signals: AC:H acknowledges that exploitation must be timed to the pending-install window - a brief period when the endpoint is vulnerable - and UI:R implies that a legitimate user (likely an admin) must be actively initiating the Jira app installation to open that window. These two factors materially reduce opportunistic exploitation risk. However, a notable inconsistency exists: the CVSS vector carries PR:L (low privileges required), yet the CVE description explicitly states 'remote unauthenticated attacker.' This conflict is unresolved in the available data and affects how defenders should model the authentication barrier. No EPSS probability was supplied for this CVE, and it is not listed in the CISA KEV catalog at time of analysis - suggesting no confirmed widespread active exploitation. The I:H and A:H impact metrics are appropriate: a rogue sharedSecret fully undermines the trust relationship between Mattermost and Jira, causing persistent integration disruption until the legitimate secret is reinstated. Overall, risk is moderate for organizations actively using the Mattermost-Jira integration, with urgency elevated during any Jira app installation or reinstallation activity.

An attacker who is monitoring network traffic or has knowledge of an ongoing Mattermost-Jira integration setup sends a crafted POST request to the target's /ac/installed endpoint immediately after an admin clicks to install the Jira integration - exploiting the brief period before the legitimate Atlassian callback arrives. The malicious payload supplies an attacker-controlled sharedSecret, which Mattermost stores without validation, replacing the legitimate trust credential. From this point, the authentic Jira integration fails JWT verification and ceases to function, while the attacker holds the only known valid sharedSecret for that integration context. No public proof-of-concept code has been identified at time of analysis.