Access Control Flaw in Mattermost Confluence Plugin Affecting User Channels
CVE-2025-53857

3.7LOW

Key Information:

Vendor

Mattermost
Status
Mattermost Confluence Plugin
Vendor
CVE Published:
11 August 2025

What is CVE-2025-53857?

The Mattermost Confluence Plugin prior to version 1.5.0 contains an access control vulnerability that permits unauthorized users to retrieve channel subscription details without sufficient permissions. This flaw arises from the plugin's failure to verify user access rights when making API calls to the GET autocomplete/GetChannelSubscriptions endpoint, potentially exposing sensitive channel information to attackers.

Affected Version(s)

Mattermost Confluence Plugin 0 < 1.5.0

Mattermost Confluence Plugin 1.5.0

References

https://mattermost.com/security-updates

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lorenzo Gallegos
.
CVE-2025-53857 : Access Control Flaw in Mattermost Confluence Plugin Affecting User Channels