What’s Vulnerable › Vulnerabilities

CVE-2025-53857: Lack of Authorization on Get Channel Subscriptions for Autocomplete in Mattermost Confluence Plugin

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-11 · updated 2026-06-17
• Weakness: CWE-862

Description

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint.

Affected products

• Mattermost Confluence Plugin: before 1.5.0 — fixed in 1.5.0

How to fix

Upgrade to a fixed version: Mattermost Confluence Plugin 1.5.0. Check the vendor advisory for mitigations.

References

• https://mattermost.com/security-updates

Get alerted when CVE-2025-53857 or the next vulnerability affects your stack