CVE-2025-54458

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to create a subscription for a Confluence space the user does not have access to via the create subscription endpoint.

Score

CVSS 3.1 5.0 Medium

Status

Analyzed - responsibledisclosure@mattermost.com

Published

2025-08-11

Last modified

2025-08-11

Weaknesses

CWE-862

Affected products

• Confluence (Mattermost)
• Mattermost Confluence Plugin (Mattermost)

References

• https://mattermost.com/security-updates