CVE-2025-54478

EPSS 0.24%
Veröffentlicht 11.08.2025 18:57:06
Zuletzt bearbeitet 24.09.2025 00:41:21
Erkennungen
Login

Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to edit channel subscriptions via API call to the edit channel subscription endpoint.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 1 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mattermost ≫ Confluence Version < 1.5.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.24%	0.149

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
responsibledisclosure@mattermost.com	7.2	3.9	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://mattermost.com/security-updates

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-54478

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-54478

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-54478

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2025-54478