CVE-2025-54478CWE-306

Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin

High · published August 11, 2025

CVSS v3.1
7.2
EPSS
0%
Percentile
14.4
In the wild
Unconfirmed
What it is

Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to edit channel subscriptions via API call to the edit channel subscription endpoint.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00241 · 14.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-08-11T18:57Z
EPSS history
Timeline
  • 11 AUG 18:57Z
    Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin
    cvelistv5