GO-2025-4247: Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection in github.com/mattermost/mattermost

  GO-2026-5833: Mattermost doesn't validate user-supplied input in API request handlers in github.com/mattermost/mattermost-plugin-github

  GO-2026-5836: Mattermost doesn't enforce request body size limits on plugin HTTP endpoints in github.com/mattermost/mattermost-plugin-github

  GO-2026-5839: Mattermost allows authenticated users to gain access to private repositories in github.com/mattermost/mattermost-plugin-github