CVE-2025-53857

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-53857
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53857.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-53857
Aliases
Downstream
Related
Published
2025-08-11T18:57:02Z
Modified
2026-08-12T03:51:18Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Lack of Authorization on Get Channel Subscriptions for Autocomplete in Mattermost Confluence Plugin
Details

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint.

Database specific 
{
    "cna_assigner": "Mattermost",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53857.json"
}
References

Affected packages

Git / github.com/mattermost/mattermost-plugin-confluence

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost-plugin-confluence
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eccd0fdb6730a5a2e5a8e3f9636b27122f024e47
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:mattermost:confluence:*:*:*:*:*:mattermost:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.5.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v0.*
v0.1.0-rc1
v0.1.0-rc2
v1.*
v1.0.0
v1.1.0
v1.1.0-rc1
v1.2.0
v1.3.0
v1.4.0-rc1
v1.5.0-rc1
v1.5.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53857.json"