Medium severity · published Aug 11, 2025
CVE-2025-8285
Unauthorized Channel Subscription Creation in Mattermost Confluence Plugin
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endpoint.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
Mattermost Confluence Plugin · Mattermost
before 1.5.0 · source: vendor
CO
Confluence · Mattermost
before 1.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8285
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8285
Vendor Advisory
https://mattermost.com/security-updates
More from Mattermost Confluence Plugin
7.5
CVE-2025-54525
Unexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin
7.5
CVE-2025-54463
Unexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence Plugin
7.5
CVE-2025-52931
Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin
7.2
CVE-2025-44004
Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin
6.4
CVE-2025-48731
Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence Plugin