CVE-2025-53910

Summary

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create a channel subscription without proper access to the channel via API call to the edit channel subscription endpoint.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost Confluence Plugin0 < 1.5.0affected
MattermostMattermost Confluence Plugin1.5.0unaffected

Weaknesses

  • CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References