CVE-2025-52931

7.5 highEPSS 0.3%

High (7.5) in mattermost confluence. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost-plugin-confluence 1.5.0.

Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWE: CWE-754
Published: 2025-08-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mattermost:confluence

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-vc77-c2hx-h5x2	Go	github.com/mattermost/mattermost-plugin-confluence	<1.5.0	1.5.0
GO-2025-3870	Go	github.com/mattermost/mattermost-plugin-confluence	<1.5.0	1.5.0

References

https://mattermost.com/security-updates

Check your stack JSON