1. Home
  2. CVE Database
  3. CVE-2025-13352
LOW · 3.0

CVE-2025-13352

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction fe...

Vulnerability Description

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

CVSS Score

3.0

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
MattermostMattermost Server>= 10.11.0, < 10.11.7

Related Weaknesses (CWE)

CWE-1287

References

FAQ

What is CVE-2025-13352?

CVE-2025-13352 is a vulnerability with a CVSS score of 3.0 (LOW). Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction fe...

How severe is CVE-2025-13352?

CVE-2025-13352 has been rated LOW with a CVSS base score of 3.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-13352?

Check the references section above for vendor advisories and patch information. Affected products include: Mattermost Mattermost Server.