---
id: CVE-2025-13352
title: >-
  Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions
  <=2.4.0 fail to validate plugin bot identity in reaction forwarding which
  allows attackers to hijack the GitHub reaction feature to make users add
  reactions to …
summary: >-
  Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions
  <=2.4.0 fail to validate plugin bot identity in reaction forwarding which
  allows attackers to hijack the GitHub reaction feature to make users add
  reactions to …
severity: low
cvss: 3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N'
cwe:
  - CWE-1287
vendor: mattermost
product: mattermost_server
affected:
  - 'mattermost_server >= 10.11.0, < 10.11.7'
patched:
  - mattermost_server 10.11.7
published: '2025-12-17'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13352'
references:
  - url: 'https://mattermost.com/security-updates'
    label: responsibledisclosure@mattermost.com
tags:
  - nvd
epss: 0.00175
epssPercentile: 0.06353
ingestedAt: '2026-10-13T11:23:51.116Z'
---

## Overview

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

## Affected

- `mattermost_server >= 10.11.0, < 10.11.7`

## Remediation

Upgrade past the affected range:

- `mattermost_server 10.11.7`