Authentication Bypass Vulnerability in Mattermost Confluence Plugin
CVE-2025-54478

7.2HIGH

Key Information:

Vendor: Mattermost
Status: Mattermost Confluence Plugin
Vendor: CVE Published:; 11 August 2025

What is CVE-2025-54478?

The Mattermost Confluence Plugin version below 1.5.0 contains a vulnerability that fails to enforce proper user authentication. This oversight permits unauthenticated attackers to exploit the API, allowing them to modify channel subscriptions without any authorization. Such access can lead to unauthorized changes within the Mattermost instance, posing significant risks to its users and their data integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Mattermost Confluence Plugin 0 < 1.5.0

Mattermost Confluence Plugin 1.5.0

References

https://mattermost.com/security-updates

CVSS V3.1

Score:

7.2

Severity:

HIGH

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Changed

Timeline

Vulnerability published
Aug 11, 2025
Vulnerability Reserved
Jul 28, 2025

Credit

Lorenzo Gallegos

JSON

Mattermost