TI-2025-12355 Aliases CVE-2025-13523 GHSA-ffx7-34p2-vm3w

Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow

LOW 33CWE-79Published 2026-02-06 · Updated 2026-02-06

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00216 12th percentileScored 2026-11-07

Fix Fixed Mattermost Confluence Plugin (Mattermost): 1.7.0github.com/mattermost/mattermost-plugin-confluence (Go): 1.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Mattermost	Mattermost Confluence Plugin	before 1.7.0	1.7.0	Patch available	CNA
—	github.com/mattermost/mattermost-plugin-confluence (Go)	before 1.7.0	1.7.0	Patch available	GHSA-ffx7-34p2-vm3w

Mattermost Confluence Plugin VendorMattermost Affected before 1.7.0 Fixed in 1.7.0 Patch available CNA
github.com/mattermost/mattermost-plugin-confluence (Go) Vendor— Affected before 1.7.0 Fixed in 1.7.0 Patch available GHSA-ffx7-34p2-vm3w

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mattermost:confluence::::::mattermost::*	1.0.0 to before 1.7.0	Vulnerable	Mattermost

cpe:2.3:a:mattermost:confluence:*:*:*:*:*:mattermost:*:* Versions 1.0.0 to before 1.7.0 Vulnerable ·Mattermost

Remediation

Fix · CNA Mattermost Confluence Plugin (Mattermost) Fixed in 1.7.0
Fix · GHSA-ffx7-34p2-vm3w github.com/mattermost/mattermost-plugin-confluence (Go) Fixed in 1.7.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-13523
2026-10-03 Alias added: GHSA-ffx7-34p2-vm3w

References

Advisory 2

Other 1

https://github.com/mattermost/mattermost-plugin-confluence

TI-2025-34309 Unexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin CVSS 3.1HIGH 7.5
TI-2025-34260 Unexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence Plugin CVSS 3.1HIGH 7.5
TI-2025-32962 Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin CVSS 3.1HIGH 7.5
TI-2025-34275 Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin CVSS 3.1HIGH 7.2
TI-2025-28553 Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin CVSS 3.1HIGH 7.2
TI-2025-30953 Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence Plugin CVSS 3.1MEDIUM 6.4

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences