CVE-2025-13352

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

CVSS v3 3.0 LOW

3.0^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.3 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*

History

13 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Mattermost 10.11.x menor o igual que 10.11.6 y las versiones del plugin de GitHub de Mattermost menor o igual que 2.4.0 no validan la identidad del bot del plugin en el reenvío de reacciones, lo que permite a los atacantes secuestrar la función de reacción de GitHub para hacer que los usuarios añadan reacciones a objetos arbitrarios de GitHub a través de publicaciones de notificación manipuladas.

Information

Published : 2025-12-17 13:15

Updated : 2026-10-13 11:10

NVD link : CVE-2025-13352

Mitre link : CVE-2025-13352

CVE.ORG link : CVE-2025-13352

JSON object : View

Products Affected

mattermost

mattermost_server

CWE

CWE-1287

Improper Validation of Specified Type of Input

{"id": "CVE-2025-13352", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13352", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-17T15:05:37.727945Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.0, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.3}]}, "affected": [{"source": "responsibledisclosure@mattermost.com", "affectedData": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "10.11.0", "versionType": "semver", "lessThanOrEqual": "10.11.6"}, {"status": "unaffected", "version": "11.1.0"}, {"status": "unaffected", "version": "10.11.7"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-17T13:15:56.627", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-1287"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts."}, {"lang": "es", "value": "Las versiones de Mattermost 10.11.x menor o igual que 10.11.6 y las versiones del plugin de GitHub de Mattermost menor o igual que 2.4.0 no validan la identidad del bot del plugin en el reenv\u00edo de reacciones, lo que permite a los atacantes secuestrar la funci\u00f3n de reacci\u00f3n de GitHub para hacer que los usuarios a\u00f1adan reacciones a objetos arbitrarios de GitHub a trav\u00e9s de publicaciones de notificaci\u00f3n manipuladas."}], "lastModified": "2026-10-13T11:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB4AD9AE-B2DB-4D49-87AD-FA5F9CE6A0C8", "versionEndExcluding": "10.11.7", "versionStartIncluding": "10.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}