CVE-2025-54478
Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin
Summary
Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin
Original description
The description as published by the source.
Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to edit channel subscriptions via API call to the edit channel subscription endpoint.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web mattermost.com