CVE-2025-53857: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details…

PriorityP417low3.7CVSS 3.1

AVNACHPRNUINSUCLINAN

EPSS

0.21%

10.7th percentile

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost-plugin-confluence	>= 0 < 1.5.0	1.5.0
mattermost	confluence	< 1.5.0	1.5.0
mattermost	mattermost_confluence_plugin	< 1.5.0	1.5.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.