CVE-2025-54478
BaseFortify
Publication date: 2025-08-11
Last updated on: 2025-09-24
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | confluence | to 1.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Mattermost Confluence Plugin versions before 1.5.0, where the plugin fails to enforce user authentication to the Mattermost instance. This flaw allows unauthenticated attackers to make API calls to the edit channel subscription endpoint and modify channel subscriptions without proper authorization.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can edit channel subscriptions without authentication, potentially leading to unauthorized changes in communication channels. This could disrupt normal operations, cause information to be sent to unintended recipients, or be used as a vector for further attacks.