GitHub Advisoryadvisory · Go

GHSA-cmpr-8prq-w5p5 Mattermost Confluence Plugin has Missing Authorization vulnerability

MEDIUM Published 2025-08-11 Modified 2025-08-11 Official page ↗
Aliases
CVE-2025-48731
Ecosystem
Go
Packages
github.com/mattermost/mattermost-plugin-confluence
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-862
Reviewed
2025-08-11

Affected packages

• Go github.com/mattermost/mattermost-plugin-confluence: < 1.5.0 → fixed in 1.5.0

Description

Mattermost Confluence Plugin versions < 1.5.0 fail to check user access to Confluence spaces, which allows attackers to edit subscriptions for Confluence spaces that users do not have access to through the edit subscription endpoint.

Related

Alias · CVE (1)

  • CVE-2025-48731 Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References