Cloudanix VulnDB

CVE-2025-13352

Low · 3.0

Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection

CVSS

3.0

EPSS

0.2%

Published

Dec 17, 2025

CISA due date

—

The record

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/mattermost/mattermost 0 10.11.7-0.20251106103514-3b05384dd014
Go github.com/mattermost/mattermost 11.0.0-alpha.1 11.1.0
Go github.com/mattermost/mattermost 11.0.0-alpha.1+incompatible 11.1.0+incompatible
Go github.com/mattermost/mattermost-plugin-github 0 1.0.1-0.20250829075715-0deffcfc6bee
Go github.com/mattermost/mattermost-server 10.11.0-rc1+incompatible No fix
Go github.com/mattermost/mattermost-server/v5 0 No fix
Go github.com/mattermost/mattermost-server/v6 0 No fix
Go github.com/mattermost/mattermost/server/v8 0 No fix
Go github.com/mattermost/mattermost/server/v8 10.11.0-rc1 10.11.7-0.20251106103514-3b05384dd014
go github.com/mattermost/mattermost 11.0.0-alpha.1 11.1.0
go github.com/mattermost/mattermost/server/v8 10.11.0-rc1 10.11.7-0.20251106103514-3b05384dd014
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20251230T014957-150000.1.134.1

Related vulnerabilities