CVE-2025-8285

medium

Description

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endpoint.

References

https://mattermost.com/security-updates

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24169

Details

Source: Mitre, NVD

Published: 2025-08-11

Updated: 2025-09-24

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 5.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N