CVE-2025-13352

lowpriority · track · 0EPSS 0.002 · 7 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.18% (7th) EPSS

CVSS 3 · low

Is it mine?

13 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-28

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

cvss

Technical severity, 0–10. One row per scoring source.

3.0

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.13lowAV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.13lowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:Nsecondary · ENISA EU

v3.13lowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:Nsecondary · responsibledisclosure@mattermost.comexploitability 1.3 · impact 1.4

v3.13lowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:Nsecondary · OSV

v3.12.8lowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1287USCWE-1287USCWE-1287US

affected products (13)

Products and version ranges known to be affected.

Mattermost Mattermost≤ 10.11.0 ≤10.11.6enisa_euvdEU
Mattermost Inc Mattermost10.11.0 → 10.11.6fstec_bduRU
Mattermost Inc Mattermost GitHub Plugin≤ 2.4.0fstec_bduRU
mattermost mattermost server10.11.0 → 10.11.7nvdUScpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
Go github.com/mattermost/mattermost< 10.11.7-0.20251106103514-3b05384dd014osvUSpkg:golang/github.com/mattermost/mattermost
Go github.com/mattermost/mattermost11.0.0-alpha.1 → 11.1.0osvUSpkg:golang/github.com/mattermost/mattermost
Go github.com/mattermost/mattermost11.0.0-alpha.1+incompatible → 11.1.0+incompatibleosvUSpkg:golang/github.com/mattermost/mattermost
Go github.com/mattermost/mattermost-plugin-github< 1.0.1-0.20250829075715-0deffcfc6beeosvUSpkg:golang/github.com/mattermost/mattermost-plugin-github
Go github.com/mattermost/mattermost-server≥ 10.11.0-rc1+incompatibleosvUSpkg:golang/github.com/mattermost/mattermost-server
Go github.com/mattermost/mattermost-server/v5all versionsosvUSpkg:golang/github.com/mattermost/mattermost-server/v5
Go github.com/mattermost/mattermost-server/v6all versionsosvUSpkg:golang/github.com/mattermost/mattermost-server/v6
Go github.com/mattermost/mattermost/server/v8all versionsosvUSpkg:golang/github.com/mattermost/mattermost/server/v8
Go github.com/mattermost/mattermost/server/v810.11.0-rc1 → 10.11.7-0.20251106103514-3b05384dd014osvUSpkg:golang/github.com/mattermost/mattermost/server/v8

advisories (2)

Vendor and ecosystem advisories describing this.

GHSA-jf5h-xfw4-p8gpMattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection2025-12-17ghsa · osvUS
Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.
GO-2025-4247Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection in github.com/mattermost/mattermost2025-12-22vendor · osvUS
Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection in github.com/mattermost/mattermost. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/mattermost/mattermost before v10.11.7-0.20251106103514-3b05384dd014; github.com/mattermost/mattermost-server before v10.11.7-0.20251106103514-3b05384dd014.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv nvd NVD CVE.org MITRE

published 2025-12-17modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan