GitHub Advisoryadvisory · Go

GHSA-qjrx-j8wm-xf83 Mattermost Confluence Plugin has Missing Authorization vulnerability

MEDIUM Published 2025-08-11 Modified 2025-09-24 Official page ↗
Aliases
CVE-2025-8285
Ecosystem
Go
Packages
github.com/mattermost/mattermost-plugin-confluence
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2025-08-11

Affected packages

• Go github.com/mattermost/mattermost-plugin-confluence: < 1.5.0 → fixed in 1.5.0

Description

Mattermost Confluence Plugin versions < 1.5.0 fail to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endpoint.

Related

Alias · CVE (1)

  • CVE-2025-8285 Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References