Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection

🗓️ 17 Dec 2025 15:34:53Reported by GitHub Advisory DatabaseType

Bot identity bypass allows arbitrary GitHub reactions in Mattermost 10.11.x and GitHub plugin 2.4.0.

Reporter	Title	Published	Views	Family All 20
Circl	CVE-2025-13352	17 Dec 202515:35	–	circl
CNNVD	Mattermost 安全漏洞	17 Dec 202500:00	–	cnnvd
CVE	CVE-2025-13352	17 Dec 202512:11	–	cve
Cvelist	CVE-2025-13352 Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking	17 Dec 202512:11	–	cvelist
EUVD	EUVD-2025-203891	17 Dec 202515:34	–	euvd
NVD	CVE-2025-13352	17 Dec 202513:15	–	nvd
OSV	GHSA-JF5H-XFW4-P8GP Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection	17 Dec 202515:34	–	osv
OSV	GO-2025-4247 Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection in github.com/mattermost/mattermost	22 Dec 202518:15	–	osv
OSV	SUSE-SU-2026:0037-1 Security update for govulncheck-vulndb	6 Jan 202610:24	–	osv
Positive Technologies	PT-2025-47494	19 Nov 202500:00	–	ptsecurity

Vulners

Node

mattermost mattermost-plugin-githubRange<1.0.1-0.20250829075715-0deffcfc6beego

mattermost mattermostRange11.0.0-alpha.1–11.1.0go

mattermost mattermostRange<10.11.7-0.20251106103514-3b05384dd014go

mattermost mattermostRange10.11.0-rc1–10.11.7-0.20251106103514-3b05384dd014go

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-13352
mattermost	www.mattermost.com/security-updates
github	www.github.com/mattermost/mattermost-plugin-github/commit/0deffcfc6bee7eaf01f7c99100e3d12e8d9df68c
github	www.github.com/mattermost/mattermost/commit/3b05384dd0146c1be3caa620a42e00e46027055d
github	www.github.com/advisories/GHSA-jf5h-xfw4-p8gp

17 Dec 2025 22:49Current

7High risk

Vulners AI Score7

CVSS 3.13

EPSS0.00053