PT-2025-32582 · Mattermost · Mattermost Confluence Plugin

Lorenzo Gallegos · Published 2025-07-10 · Updated 2025-08-20 · CVE-2025-54478

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Mattermost Confluence Plugin versions prior to 1.5.0

Description: The Mattermost Confluence Plugin does not enforce authentication for users accessing the Mattermost instance. This allows unauthenticated attackers to modify channel subscriptions by making API calls to the edit channel subscription endpoint.

Recommendations: Update Mattermost Confluence Plugin to version 1.5.0 or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-09763

CVE-2025-54478

GHSA-QPJQ-C5HR-7925

GO-2025-3875

OPENSUSE-SU-2025:15469-1

Affected Products

Mattermost Confluence Plugin

References · 31

• https://osv.dev/vulnerability/openSUSE-SU-2025:15469-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qpjq-c5hr-7925 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09763 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54478 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54478 · Security Note
• https://github.com/mattermost/mattermost-plugin-confluence · Note
• https://suse.com/security/cve/CVE-2025-52931 · Note
• https://suse.com/security/cve/CVE-2025-55196 · Note
• https://suse.com/security/cve/CVE-2025-55198 · Note
• https://suse.com/security/cve/CVE-2025-54525 · Note
• https://suse.com/security/cve/CVE-2025-54478 · Note
• https://suse.com/security/cve/CVE-2025-54458 · Note
• https://suse.com/security/cve/CVE-2025-50946 · Note