-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the provided commits reveals the root cause of the vulnerability. The commit 0deffcfc6bee7eaf01f7c99100e3d12e8d9df68c in the mattermost/mattermost-plugin-github repository contains the security fix. The change is located in the server/plugin/plugin.go file, specifically in the getPostPropsForReaction function. The patch introduces a check to validate that the post being reacted to was created by the bot (post.UserId != p.BotUserID). The absence of this check in vulnerable versions allowed the plugin to process reactions on any post, which could be exploited by an attacker to add GitHub reactions to arbitrary objects. The second commit, 3b05384dd0146c1be3caa620a42e00e46027055d, in the mattermost/mattermost repository, simply updates the version of the pre-packaged GitHub plugin to include this fix, confirming that the vulnerability resides within the plugin itself.
plugin.getPostPropsForReactionserver/plugin/plugin.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | >= 10.11.0-rc1, < 10.11.7-0.20251106103514-3b05384dd014 | 10.11.7-0.20251106103514-3b05384dd014 |
| github.com/mattermost/mattermost | go | < 10.11.7-0.20251106103514-3b05384dd014 | 10.11.7-0.20251106103514-3b05384dd014 |
| github.com/mattermost/mattermost | go | >= 11.0.0-alpha.1, < 11.1.0 | 11.1.0 |
| github.com/mattermost/mattermost-plugin-github | go | < 1.0.1-0.20250829075715-0deffcfc6bee | 1.0.1-0.20250829075715-0deffcfc6bee |