PatchTheCVECVE-2025-8285: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows
CVE-2025-8285 is a medium-severity flaw (CVSS 4.0) affecting confluence. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endpoint.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.0 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 91%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2025-08-11 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-8285?
confluence: upgrade to 1.5.0. Exact commands for each OS are on this page.
Is CVE-2025-8285 being exploited?
CVE-2025-8285 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-8285 affect?
CVE-2025-8285 affects confluence. Severity is medium (CVSS 4.0). Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endp
How urgent is CVE-2025-8285?
Priority 21/100. Remotely exploitable, no login, no user action
Software pages
Atlassian Confluence vulnerabilities · Mattermost vulnerabilities
Related CVEs
- CVE-2025-54525 HIGH 7.5 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to
- CVE-2025-54478 HIGH 7.2 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost inst
- CVE-2025-54463 MEDIUM 5.9 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to
- CVE-2025-54458 MEDIUM 5.0 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space whic
- CVE-2025-53910 MEDIUM 4.0 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows