PT-2025-32570 · WordPress · Mattermost Confluence Plugin

Lorenzo Gallegos · Published 2025-07-10 · Updated 2025-08-20 · CVE-2025-44001

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Mattermost Confluence Plugin versions prior to 1.5.0

Description: The Mattermost Confluence Plugin does not verify user access to channels, potentially allowing unauthorized access to channel subscription details. This occurs through an API call to the Get Channel Subscriptions details endpoint.

Recommendations: Update Mattermost Confluence Plugin to version 1.5.0 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-09757

CVE-2025-44001

GHSA-VPCR-FQPC-386H

GO-2025-3863

OPENSUSE-SU-2025:15469-1

Affected Products

Mattermost Confluence Plugin

References · 31

• https://osv.dev/vulnerability/CVE-2025-44001 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3863 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15469-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09757 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vpcr-fqpc-386h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-44001 · Security Note
• https://github.com/mattermost/mattermost-plugin-confluence · Note
• https://suse.com/security/cve/CVE-2025-52931 · Note
• https://suse.com/security/cve/CVE-2025-55196 · Note
• https://twitter.com/VulmonFeeds/status/1955042773553361180 · Twitter Post
• https://suse.com/security/cve/CVE-2025-55198 · Note
• https://suse.com/security/cve/CVE-2025-54525 · Note
• https://suse.com/security/cve/CVE-2025-54478 · Note
• https://suse.com/security/cve/CVE-2025-54458 · Note