GitHub Advisoryadvisory · Go

GHSA-jf5h-xfw4-p8gp Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection

LOW Published 2025-12-17 Modified 2025-12-17 Official page ↗
Aliases
CVE-2025-13352
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost, github.com/mattermost/mattermost-plugin-github
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
Weaknesses
CWE-1287
Reviewed
2025-12-17

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 10.11.0-rc1, < 10.11.7-0.20251106103514-3b05384dd014 → fixed in 10.11.7-0.20251106103514-3b05384dd014 • Go github.com/mattermost/mattermost: < 10.11.7-0.20251106103514-3b05384dd014 → fixed in 10.11.7-0.20251106103514-3b05384dd014 • Go github.com/mattermost/mattermost: >= 11.0.0-alpha.1, < 11.1.0 → fixed in 11.1.0 • Go github.com/mattermost/mattermost-plugin-github: < 1.0.1-0.20250829075715-0deffcfc6bee → fixed in 1.0.1-0.20250829075715-0deffcfc6bee

Description

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

Related

Alias · CVE (1)

  • CVE-2025-13352 Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction… vulnerability

Weakness · CWE (1)

  • CWE-1287 Improper Validation of Specified Type of Input weakness

References