Authentication Bypass in Mattermost Confluence Plugin

CVE-2025-49221

What is CVE-2025-49221?

The Mattermost Confluence Plugin versions prior to 1.5.0 contain a significant security flaw that enables unauthorized users to bypass authentication. This vulnerability allows unauthenticated attackers to exploit the plugin's API, specifically the subscription endpoint, thereby gaining access to sensitive subscription details without proper credentials. Such an exploit poses serious risks to the integrity and confidentiality of user data within the Mattermost environment.

References