~ / search / GHSA-jf5h-xfw4-p8gp

GHSA-jf5h-xfw4-p8gp

Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection

Source: GitHub Advisory Database (reviewed) Low CVE-2025-13352

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost/server/v8 >= 10.11.0-rc1, < 10.11.7-0.20251106103514-3b05384dd014 10.11.7-0.20251106103514-3b05384dd014
Go github.com/mattermost/mattermost < 10.11.7-0.20251106103514-3b05384dd014 10.11.7-0.20251106103514-3b05384dd014
Go github.com/mattermost/mattermost >= 11.0.0-alpha.1, < 11.1.0 11.1.0
Go github.com/mattermost/mattermost-plugin-github < 1.0.1-0.20250829075715-0deffcfc6bee 1.0.1-0.20250829075715-0deffcfc6bee

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

References

External links from the advisory. They lead to third-party sites.