GHSA-qvmc-92vg-6r35

Source

https://github.com/advisories/GHSA-qvmc-92vg-6r35

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-qvmc-92vg-6r35/GHSA-qvmc-92vg-6r35.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qvmc-92vg-6r35

Aliases

Published

2025-12-22T12:30:21Z

Modified

2026-02-03T03:14:36.404193Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L CVSS Calculator

Summary

Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm

Details

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue key paths. Mattermost Advisory ID: MMSA-2025-00555

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-02T15:34:07Z",
    "cwe_ids": [
        "CWE-303"
    ],
    "nvd_published_at": "2025-12-22T12:16:19Z",
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.0.0-20251121122154-b57c297c6d7a

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-qvmc-92vg-6r35/GHSA-qvmc-92vg-6r35.json"

Go / github.com/mattermost/mattermost-plugin-jira

Package

Name: github.com/mattermost/mattermost-plugin-jira; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost-plugin-jira

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.4.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-qvmc-92vg-6r35/GHSA-qvmc-92vg-6r35.json"