CVE-2025-49221 — Unauthenticated Access to Channel Subscription in Mattermost Confluence Plugin

CVE-2025-49221

Unauthenticated Access to Channel Subscription in Mattermost Confluence Plugin PUBLISHED

Description (CNA)

Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to access subscription details without via API call to GET subscription endpoint.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost Confluence Plugin	affected 0 before 1.5.0; unaffected 1.5.0

CWE

CWE-862

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.