CVE-2025-54478 — Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin

CVE-2025-54478

Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin PUBLISHED

Description (CNA)

Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to edit channel subscriptions via API call to the edit channel subscription endpoint.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost Confluence Plugin	affected 0 before 1.5.0; unaffected 1.5.0

CWE

CWE-306

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.