Cloudanix VulnDB

GO-2025-4247

None

CVSS

—

EPSS

—

Published

Dec 22, 2025

CISA due date

—

The record

Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection in github.com/mattermost/mattermost

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/mattermost/mattermost 0 10.11.7-0.20251106103514-3b05384dd014
Go github.com/mattermost/mattermost 11.0.0-alpha.1 11.1.0
Go github.com/mattermost/mattermost 11.0.0-alpha.1+incompatible 11.1.0+incompatible
Go github.com/mattermost/mattermost-plugin-github 0 1.0.1-0.20250829075715-0deffcfc6bee
Go github.com/mattermost/mattermost-server 10.11.0-rc1+incompatible No fix
Go github.com/mattermost/mattermost-server/v5 0 No fix
Go github.com/mattermost/mattermost-server/v6 0 No fix
Go github.com/mattermost/mattermost/server/v8 0 No fix
Go github.com/mattermost/mattermost/server/v8 10.11.0-rc1 10.11.7-0.20251106103514-3b05384dd014
go github.com/mattermost/mattermost 11.0.0-alpha.1 11.1.0
go github.com/mattermost/mattermost/server/v8 10.11.0-rc1 10.11.7-0.20251106103514-3b05384dd014

Related vulnerabilities