Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost-server | go | = 11.6.0 | 11.6.1 |
| github.com/mattermost/mattermost-server | go | >= 11.5.0, < 11.5.4 | 11.5.4 |
| github.com/mattermost/mattermost-server | go | >= 11.4.0, < 11.4.5 | 11.4.5 |
| github.com/mattermost/mattermost-server | go | >= 10.11.0, < 10.11.15 | 10.11.15 |
| github.com/mattermost/mattermost-plugin-github | go | < 1.0.1-0.20260318132218-6e6b740c4852 | 1.0.1-0.20260318132218-6e6b740c4852 |
Miggo AIRoot Cause AnalysisThe root cause of the vulnerability is the lack of OAuth scope validation in the completeConnectUserToGitHub function within the mattermost-plugin-github plugin. When a user connects their GitHub account to Mattermost, the plugin initiates an OAuth flow. An attacker could manipulate the scope parameter in the authorization URL sent to the user. By adding the repo scope, which grants access to private repositories, the user would be prompted to authorize this extended access. Upon successful authorization, GitHub would send an authorization code back to Mattermost. The completeConnectUserToGitHub function, which handles this callback, would then exchange the code for an access token. The vulnerability lies here: the function did not check the scopes associated with the obtained token against the scopes that were actually requested or allowed by the Mattermost configuration. As a result, a token with elevated privileges (repo scope) was stored and used, granting the Mattermost user access to the user's private GitHub repositories through the plugin, even if the system administrator had disabled private repository access. The patch mitigates this by introducing a validateOAuthScopes function that inspects the X-OAuth-Scopes header in the GitHub API response and ensures that the granted scopes do not exceed the allowed permissions.
