What is CVE-2025-14273?

CVE-2025-14273 is a high-severity vulnerability in Mattermost, classified under Incorrect Implementation of Authentication Algorithm. CVSS score: 7.2/10. Published 2025-12-22.

How severe is CVE-2025-14273?

High severity. CVSS v3 base score is 7.2 out of 10.

Vulnerability in Mattermost

CVE-2025-14273

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue key paths. Mattermost Advisory ID: MMSA-2025-00555

EPSS: 0.002 (14.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L.

Affected products

Mattermost — versions 11.1.0, 11.0.0, 10.12.0
Mattermost Mattermost_server

Weakness classification (CWE)

CWE-303 — Incorrect Implementation of Authentication Algorithm

References

responsibledisclosure@mattermost.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-14273?: CVE-2025-14273 is a high-severity vulnerability in Mattermost, classified under Incorrect Implementation of Authentication Algorithm. CVSS score: 7.2/10. Published 2025-12-22.
How severe is CVE-2025-14273?: High severity. CVSS v3 base score is 7.2 out of 10.