CVE-2025-53857
BaseFortify
Publication date: 2025-08-11
Last updated on: 2025-09-25
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | confluence | to 1.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Mattermost Confluence Plugin versions before 1.5.0, where the plugin fails to verify if a user has access to a channel before allowing them to retrieve channel subscription details. Attackers can exploit this by making an API call to the GET autocomplete/GetChannelSubscriptions endpoint to obtain subscription information for channels they do not have permission to access.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of channel subscription details to attackers who do not have proper access. This could expose sensitive information about channel memberships or subscriptions, potentially leading to privacy concerns or further targeted attacks.