CVE-2025-53857

EPSS 0.04%
Published 11.08.2025 18:57:02
Last modified 25.09.2025 18:55:50
Source responsibledisclosure@mattermo
Teams watchlist Login
Open Login

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint.

Affected products Warnungen 0 Metrics 2 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Mattermost ≫ Confluence SwPlatformmattermost Version < 1.5.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.04%	0.125

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
responsibledisclosure@mattermost.com	3.7	2.2	1.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://mattermost.com/security-updates

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-53857

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-53857

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-53857

EUVD