CVE-2025-53857

EPSS 0.04%
Veröffentlicht 11.08.2025 18:57:02
Zuletzt bearbeitet 25.09.2025 18:55:50
Quelle responsibledisclosure@mattermo
Teams Watchlist Login
Unerledigt Login

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mattermost ≫ Confluence SwPlatformmattermost Version < 1.5.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.04%	0.125

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
responsibledisclosure@mattermost.com	3.7	2.2	1.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://mattermost.com/security-updates

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-53857

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-53857

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-53857

EUVD