PT-2025-32583 · Mattermost · Mattermost Confluence Plugin

Lorenzo Gallegos · CVE-2025-54525 · Published 2025-07-10 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Mattermost Confluence Plugin versions prior to 1.5.0

Description: The Mattermost Confluence Plugin does not properly handle unexpected request bodies. This allows attackers to crash the plugin by repeatedly sending requests with invalid bodies to the channel subscription creation endpoint.

Recommendations: Update the Mattermost Confluence Plugin to version 1.5.0 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1287

Related Identifiers

BDU:2025-09765

CVE-2025-54525

GHSA-3CG3-3MMR-W8HJ

GO-2025-3872

OPENSUSE-SU-2025:15469-1

OPENSUSE-SU-2026:21483-1

Affected Products

Mattermost Confluence Plugin

References · 1748

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54525.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-54525 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3cg3-3mmr-w8hj · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15469-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54525 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3872 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09765 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/mattermost/mattermost-plugin-confluence · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note