CVE-2025-49221CWE-862

Unauthenticated Access to Channel Subscription in Mattermost Confluence Plugin

Low · published August 11, 2025

CVSS v3.1
3.7
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to access subscription details without via API call to GET subscription endpoint.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00249 · 15.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-08-11T18:56Z
EPSS history
Timeline
  • 11 AUG 18:56Z
    Unauthenticated Access to Channel Subscription in Mattermost Confluence Plugin
    cvelistv5