Unauthorized Channel Subscription in Mattermost Confluence Plugin

CVE-2025-53910

What is CVE-2025-53910?

The Mattermost Confluence Plugin prior to version 1.5.0 contains an access control flaw. The plugin does not properly verify user permissions for accessing channels, enabling malicious users to create channel subscriptions without appropriate rights. This vulnerability can be exploited via API calls to the edit channel subscription endpoint, leading to potential unauthorized access to sensitive channel content.

References