GHSA-qpjq-c5hr-7925

Mattermost Confluence Plugin is Missing Authentication for Critical Function

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-54478

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/mattermost/mattermost-plugin-confluence	< 1.5.0	1.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost Confluence Plugin versions < 1.5.0 fail to enforce user authentication of the Mattermost instance, allowing unauthenticated attackers to edit channel subscriptions via API call to the edit channel subscription endpoint.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-54478 advisory
https://mattermost.com/security-updates web