CVE-2025-64641

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.7 Mattermost versions 10.12.x through 10.12.3 Mattermost versions 11.0.x through 11.0.5 Mattermost versions 11.1.x through 11.1.0

Description Mattermost fails to verify that post actions invoking '/share-issue-publicly' were created by the Jira plugin. This allows a malicious Mattermost user to potentially exfiltrate Jira tickets when victim users interact with affected posts.

Recommendations Update Mattermost to a version later than 10.11.7. Update Mattermost to a version later than 10.12.3. Update Mattermost to a version later than 11.0.5. Update Mattermost to a version later than 11.1.0.