medium5.0
CVE-2025-54458
Mattermost Confluence Plugin has Missing Authorization vulnerability
Impact
Mattermost Confluence Plugin versions < 1.5.0 fails to check user access of the Confluence space, allowing attackers to create a subscription to a Confluence space the user does not have access to via the create subscription endpoint.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost-plugin-confluence | < 1.5.0 | 1.5.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Confluence | before 1.5.0 |