CVE-2025-13767

Summary

Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues in github.com/mattermost/mattermost-server

Severity

medium

EPSS

0.2% (p6)

Also known as

GHSA-fmqf-pmcm-8cx9, GHSA-fmqf-pmcm-8cx9#github.com/mattermost/mattermost-server, GHSA-fmqf-pmcm-8cx9#github.com/mattermost/mattermost/server/v8, GO-2025-4259, GO-2025-4259#github.com/mattermost/mattermost-server, GO-2025-4259#github.com/mattermost/mattermost-server/v5, GO-2025-4259#github.com/mattermost/mattermost-server/v6, GO-2025-4259#github.com/mattermost/mattermost/server/v8

Published

2026-02-26

References

• https://github.com/advisories/GHSA-fmqf-pmcm-8cx9
• https://nvd.nist.gov/vuln/detail/CVE-2025-13767
• https://github.com/mattermost/mattermost/commit/b57c297c6d7ae6812d85e32a625806ac9555deee

Related advisories

• CVE-2026-6346 — high · Go/github.com/mattermost/mattermost-server
• CVE-2026-6347 — high · Go/github.com/mattermost/mattermost-server
• CVE-2026-6339 — medium · Go/github.com/mattermost/mattermost-server
• CVE-2026-5163 — medium · Go/github.com/mattermost/mattermost-server
• CVE-2026-28732 — medium · Go/github.com/mattermost/mattermost-server
• CVE-2026-6345 — medium · Go/github.com/mattermost/mattermost-server
• CVE-2026-6340 — medium · Go/github.com/mattermost/mattermost-server
• CVE-2026-3637 — medium · Go/github.com/mattermost/mattermost-server

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity