GHSA-jf5h-xfw4-p8gp

Source

https://github.com/advisories/GHSA-jf5h-xfw4-p8gp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-jf5h-xfw4-p8gp/GHSA-jf5h-xfw4-p8gp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jf5h-xfw4-p8gp

Aliases

Published

2025-12-17T15:34:53Z

Modified

2025-12-22T18:41:54Z

Severity

3.0 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N CVSS Calculator

Summary

Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection

Details

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

Database specific

{
    "cwe_ids":  [
        "CWE-1287"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-12-17T22:49:46Z",
    "nvd_published_at":  "2025-12-17T13:15:56Z",
    "severity":  "LOW"
}

References

Affected packages

github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

10.11.0-rc1

Fixed

10.11.7-0.20251106103514-3b05384dd014

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-jf5h-xfw4-p8gp/GHSA-jf5h-xfw4-p8gp.json"

github.com/mattermost/mattermost

Package

Name: github.com/mattermost/mattermost; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.11.7-0.20251106103514-3b05384dd014

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-jf5h-xfw4-p8gp/GHSA-jf5h-xfw4-p8gp.json"

github.com/mattermost/mattermost

Package

Name: github.com/mattermost/mattermost; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost

Affected ranges

Type: SEMVER
Events: Introduced

11.0.0-alpha.1

Fixed

11.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-jf5h-xfw4-p8gp/GHSA-jf5h-xfw4-p8gp.json"

github.com/mattermost/mattermost-plugin-github

Package

Name: github.com/mattermost/mattermost-plugin-github; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost-plugin-github

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.1-0.20250829075715-0deffcfc6bee

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-jf5h-xfw4-p8gp/GHSA-jf5h-xfw4-p8gp.json"