PT-2025-32573 · Mattermost · Mattermost Confluence Plugin

Lorenzo Gallegos · Published 2025-08-11 · Updated 2025-08-20 · CVE-2025-49221

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Mattermost Confluence Plugin versions prior to 1.5.0

Description: The Mattermost Confluence Plugin does not enforce authentication for users accessing the Mattermost instance. This allows unauthenticated attackers to access subscription details via an API call to the GET subscription endpoint /subscription.

Recommendations: Update Mattermost Confluence Plugin to version 1.5.0 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-49221

GHSA-RFG4-2M63-FW2Q

GO-2025-3862

OPENSUSE-SU-2025:15469-1

Affected Products

Mattermost Confluence Plugin

References · 29

• https://osv.dev/vulnerability/GHSA-rfg4-2m63-fw2q · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15469-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49221 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49221 · Security Note
• https://osv.dev/vulnerability/GO-2025-3862 · Vendor Advisory
• https://github.com/mattermost/mattermost-plugin-confluence · Note
• https://suse.com/security/cve/CVE-2025-52931 · Note
• https://twitter.com/CVEnew/status/1954985237445828723 · Twitter Post
• https://suse.com/security/cve/CVE-2025-55196 · Note
• https://suse.com/security/cve/CVE-2025-55198 · Note
• https://suse.com/security/cve/CVE-2025-54525 · Note
• https://suse.com/security/cve/CVE-2025-54478 · Note
• https://suse.com/security/cve/CVE-2025-54458 · Note
• https://suse.com/security/cve/CVE-2025-50946 · Note