LOW3.0Go
GHSA-jf5h-xfw4-p8gp· CVE-2025-13352, GO-2025-4247Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection
Modified: 12/22/2025
package
Go/github.com/mattermost/mattermost-plugin-github
pkg:go/github.com/mattermost/mattermost-plugin-github
HIGH7.5Go
GHSA-jmvr-r5hm-fxfr· CVE-2026-5308, GO-2026-5836Mattermost doesn't enforce request body size limits on plugin HTTP endpoints
Modified: 7/7/2026
MEDIUM5.4Go
GHSA-r5vf-grcx-5vqp· CVE-2026-28735, GO-2026-5839Mattermost allows authenticated users to gain access to private repositories
Modified: 7/7/2026
MEDIUM4.3Go
GHSA-rmvv-8v8w-rf7x· CVE-2026-4646, GO-2026-5833Mattermost doesn't validate user-supplied input in API request handlers
Modified: 7/7/2026
—Go
GO-2025-4247· CVE-2025-13352, GHSA-jf5h-xfw4-p8gpMattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection in github.com/mattermost/mattermost
Modified: 3/3/2026
—Go
GO-2026-5833· CVE-2026-4646, GHSA-rmvv-8v8w-rf7xMattermost doesn't validate user-supplied input in API request handlers in github.com/mattermost/mattermost-plugin-github
Modified: 7/7/2026
—Go
GO-2026-5836· CVE-2026-5308, GHSA-jmvr-r5hm-fxfrMattermost doesn't enforce request body size limits on plugin HTTP endpoints in github.com/mattermost/mattermost-plugin-github
Modified: 7/7/2026
—Go
GO-2026-5839· CVE-2026-28735, GHSA-r5vf-grcx-5vqpMattermost allows authenticated users to gain access to private repositories in github.com/mattermost/mattermost-plugin-github
Modified: 7/7/2026