PT-2025-51825 · Mattermost · Mattermost+1

Juho Forsén · Published 2025-08-21 · Updated 2026-01-06 · CVE-2025-13352

Positive Technologies · (AI Summary)

CVSS v3.1

3.0

Low

AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.6 Mattermost GitHub plugin versions through 2.4.0

Description The software does not properly validate the identity of plugin bots when forwarding reactions. This allows attackers to misuse the GitHub reaction feature, potentially causing users to add reactions to unintended GitHub objects through specially crafted notification posts. The issue involves reaction forwarding and a lack of proper bot identity verification.

Recommendations Update Mattermost to a version later than 10.11.6. Update the Mattermost GitHub plugin to a version later than 2.4.0.

Fix

Weakness Enumeration

CWE-1287

Related Identifiers

BDU:2025-16347

CVE-2025-13352

GHSA-JF5H-XFW4-P8GP

GO-2025-4247

SUSE-SU-2026:0037-1

Affected Products

Mattermost

Mattermost Github Plugin

References · 91

• https://nvd.nist.gov/vuln/detail/CVE-2025-13352 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4247 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16347 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13352 · Vendor Advisory
• https://github.com/mattermost/mattermost/commit/3b05384dd0146c1be3caa620a42e00e46027055d · Note
• https://github.com/mattermost/mattermost-plugin-github/commit/0deffcfc6bee7eaf01f7c99100e3d12e8d9df68c · Note
• https://github.com/mattermost/mattermost-plugin-github/pull/925 · Note
• https://suse.com/security/cve/CVE-2025-8110 · Note
• https://suse.com/security/cve/CVE-2025-54410 · Note
• https://suse.com/security/cve/CVE-2025-65754 · Note
• https://suse.com/security/cve/CVE-2025-66565 · Note
• https://suse.com/security/cve/CVE-2025-68940 · Note
• https://suse.com/security/cve/CVE-2025-67717 · Note