Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-13352 · Microsoft / collected KEV context

EUVD-2025-203891

GHSA-jf5h-xfw4-p8gp

GO-2025-4247

cve-program · CVE-2025-13352

• https://mattermost.com/security-updates

euvd · EUVD-2025-203891

• https://mattermost.com/security-updates

nvd · CVE-2025-13352

• https://mattermost.com/security-updates

osv · GHSA-jf5h-xfw4-p8gp

• https://nvd.nist.gov/vuln/detail/CVE-2025-13352
• https://github.com/mattermost/mattermost-plugin-github/commit/0deffcfc6bee7eaf01f7c99100e3d12e8d9df68c
• https://github.com/mattermost/mattermost/commit/3b05384dd0146c1be3caa620a42e00e46027055d
• https://github.com/mattermost/mattermost
• https://mattermost.com/security-updates

osv · GO-2025-4247

• https://github.com/advisories/GHSA-jf5h-xfw4-p8gp
• https://nvd.nist.gov/vuln/detail/CVE-2025-13352
• https://github.com/mattermost/mattermost-plugin-github/commit/0deffcfc6bee7eaf01f7c99100e3d12e8d9df68c
• https://github.com/mattermost/mattermost/commit/3b05384dd0146c1be3caa620a42e00e46027055d
• https://mattermost.com/security-updates

No related operational record is retained in the current change model.