Read the docs
TI-2025-28550 Aliases CVE-2025-44001GHSA-vpcr-fqpc-386h

Unauthorized Channel Subscription Read in Mattermost Confluence Plugin

Priority LOW 18CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the Get Channel Subscriptions details endpoint.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00227 13th percentileScored 2026-11-07
Fix Fixed Mattermost Confluence Plugin (Mattermost): 1.5.0github.com/mattermost/mattermost-plugin-confluence (Go): 1.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MattermostMattermost Confluence Pluginbefore 1.5.01.5.0Patch availableCNA
—github.com/mattermost/mattermost-plugin-confluence (Go)before 1.5.01.5.0Patch availableGHSA-vpcr-fqpc-386h
  • Mattermost Confluence Plugin VendorMattermost Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA
  • github.com/mattermost/mattermost-plugin-confluence (Go) Vendor— Affected before 1.5.0 Fixed in 1.5.0 Patch available GHSA-vpcr-fqpc-386h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mattermost:confluence:*:*:*:*:*:mattermost:*:*before 1.5.0VulnerableMattermost
  • cpe:2.3:a:mattermost:confluence:*:*:*:*:*:mattermost:*:* Versions before 1.5.0 Vulnerable ·Mattermost

Remediation

  • Fix · CNA Mattermost Confluence Plugin (Mattermost) Fixed in 1.5.0
  • Fix · GHSA-vpcr-fqpc-386h github.com/mattermost/mattermost-plugin-confluence (Go) Fixed in 1.5.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Mattermost Confluence Plugin 1.5.0

    13 records Highest priority Priority LOW 13 LOW

    Other records, highest priority first

    • TI-2025-34309 Unexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence PluginPriority LOW 33
    • TI-2025-34260 Unexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence PluginPriority LOW 33
    • TI-2025-32962 Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence PluginPriority LOW 33
    Show all 13 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-44001
  2. 2026-10-03 Alias added: GHSA-vpcr-fqpc-386h

References

Advisory 2

Other 1

  • TI-2025-34309 Unexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin CVSS 3.1HIGH 7.5
  • TI-2025-34260 Unexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence Plugin CVSS 3.1HIGH 7.5
  • TI-2025-32962 Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin CVSS 3.1HIGH 7.5
  • TI-2025-12355 Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow CVSS 3.1HIGH 7.7
  • TI-2025-34275 Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin CVSS 3.1HIGH 7.2
  • TI-2025-28553 Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin CVSS 3.1HIGH 7.2
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences