← Back

CVE-2025-13352

nvd nist
Published: Dec 17, 2025Modified: Jun 17, 2026

JSON object

Loading...
3.0
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
Exploitability: 1.3 / Impact: 1.4
Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

Affected (1)

Mattermost
1 product
Mattermost Server
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost Server
From 10.11.0 to 10.11.7

Related CWEs

CWE-1287
Improper Validation of Specified Type of Input
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

References (1)

Source: responsibledisclosure@mattermost.com
Vendor Advisory

Timeline

No history available yet.