CVE-2025-48731
BaseFortify
Publication date: 2025-08-11
Last updated on: 2025-09-25
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | confluence | to 1.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Mattermost Confluence Plugin versions before 1.5.0, where the plugin fails to verify if a user has access to a specific Confluence space. As a result, an attacker can edit a subscription for a Confluence space they do not have permission to access by using the edit subscription endpoint.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can modify subscriptions for Confluence spaces they are not authorized to access. This could lead to unauthorized changes in subscription settings, potentially exposing sensitive information or disrupting normal operations related to Confluence space subscriptions.