Mattermost Server CVE-2025-13352

Requires a Mattermost server running version 10.11.x (≤ 10.11.6) with the Mattermost GitHub plugin (≤ 2.4.0) installed and configured for GitHub notification/reaction forwarding - this plugin integration is the specific feature that must be enabled. The attacker must be an authenticated low-privilege Mattermost user (PR:L) capable of posting crafted notification posts, and a victim must interact with the post to trigger reaction forwarding (UI:R). Exploitation is further limited by high attack complexity (AC:H) and yields only integrity impact (spoofed reactions on GitHub objects) with no data disclosure or service disruption.

This is a genuinely low-priority issue, and the available signals agree rather than conflict. The vendor CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N, base 3.0) describes a network-reachable but high-complexity flaw that requires an authenticated low-privilege Mattermost account (PR:L) plus victim interaction (UI:R), and delivers only a low integrity impact (I:L) with no confidentiality or availability loss. EPSS reinforces this: 0.18% probability at the 6th percentile indicates negligible expected exploitation. The vulnerability is NOT in CISA KEV and no public exploit code was identified, so there is no evidence of active or opportunistic exploitation. The scope change (S:C) is the only elevating factor - the impact lands on an external system (GitHub objects) rather than Mattermost itself - but the actual harm (spoofed emoji reactions on GitHub objects) is cosmetic/integrity-only. Note one metadata inconsistency to verify: the input Tags label this 'Information Disclosure,' yet the CVSS vector is C:N/I:L, i.e., an integrity/identity-spoofing issue, not disclosure - treat the tag as mislabeled.

An authenticated low-privilege user on a Mattermost server (10.11.x ≤ 10.11.6) running the GitHub plugin (≤ 2.4.0) crafts a notification post that the plugin bot forwards without validating its identity. When a targeted user interacts with the post, the plugin applies that user's reaction to an attacker-chosen GitHub object, letting the attacker spoof reactions on arbitrary issues or PRs. No public proof-of-concept exploit was identified at the time of analysis.