Listen to this Post
The vulnerability exists in the integration between Mattermost and Jira. When an authenticated user requests to attach a Mattermost post as a comment to a Jira issue, the server-side function responsible for this action accepts a post identifier without subsequently verifying the user’s membership in the channel where that post resides. The affected endpoint does not call the appropriate authorization middleware that checks channel permissions. Instead, it directly fetches the post content and associated file attachments using the provided ID, assuming the request has been pre-authorized. This broken authorization logic allows any user with general plugin access (the ability to use the Jira slash command or interact with the plugin) to exfiltrate data. By manipulating the `post_id` parameter in the API call to the attachment handler, an attacker can reference posts from private, direct, or team channels they are not part of. The server then proceeds to format the post’s content, including any embedded files, and successfully submits it to the specified Jira issue, which the attacker can view. This results in a clear Insecure Direct Object Reference (IDOR) flaw, bypassing Mattermost’s channel-based access control model entirely.
Platform: Mattermost
Version: 10.11.0-10.11.7
Version: 10.12.0-10.12.3
Version: 11.0.0-11.0.5
Version: 11.1.0
Vulnerability: IDOR via Jira
Severity: Moderate
date: Dec 24, 2025
Prediction: Patched Dec 24, 2025
What Undercode Say:
curl -X POST -H "Authorization: Bearer <TOKEN>" -H "Content-Type: application/json" -d '{"post_id":"<TARGET_POST_ID>", "jira_issue_key":"PROJ-123"}' https://mattermost.example.com/plugins/jira/api/v2/attach-post
// Hypothetical vulnerable code snippet
func handleAttachPost(c Context, postId string) {
post, err := c.App.GetPost(postId) // No channel membership check
if err != nil {
c.Err = err
return
}
// Attach post to Jira...
}
How Exploit:
Authenticated attacker identifies valid post IDs (e.g., via predictable IDs, other leaks). Attacker uses Jira plugin API endpoint, supplying a target post ID from a private channel. Server fetches post and attachments without authorization. Attacker views sensitive data in the Jira issue comment.
Protection from this CVE:
Upgrade to patched versions: 10.11.8, 10.12.4, 11.0.6, 11.1.1, or 8.0.0-20251121122154-b57c297c6d7.
Impact:
Information disclosure from private channels. Unauthorized read access to posts and file attachments via Jira integration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
