CVE-2025-13352 — Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking

CVE-2025-13352

Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking PUBLISHED

Description (CNA)

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 10.11.0 through 10.11.6; unaffected 11.1.0; unaffected 10.11.7

CWE

CWE-1287

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.