~ / search / GHSA-vpcr-fqpc-386h

GHSA-vpcr-fqpc-386h

Mattermost Confluence Plugin has Missing Authorization vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-44001

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost-plugin-confluence < 1.5.0 1.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost Confluence Plugin versions < 1.5.0 fail to check user access to the channel, which allows attackers to get channel subscription details without proper access to the channel via an API call to the Get Channel Subscriptions details endpoint.

References

External links from the advisory. They lead to third-party sites.