PT-2025-32571 · WordPress · Mattermost Confluence Plugin

Lorenzo Gallegos · Published 2025-07-10 · Updated 2025-08-20 · CVE-2025-44004

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Mattermost Confluence Plugin versions prior to 1.5.0

Description: The Mattermost Confluence Plugin does not verify user authorization to the Mattermost instance, enabling attackers to create channel subscriptions without proper authorization. This is achieved through an API call to the create channel subscription endpoint.

Recommendations: Update Mattermost Confluence Plugin to version 1.5.0 or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-09764

CVE-2025-44004

GHSA-6FF3-JGXH-VFFJ

GO-2025-3865

OPENSUSE-SU-2025:15469-1

Affected Products

Mattermost Confluence Plugin

References · 30

• https://osv.dev/vulnerability/openSUSE-SU-2025:15469-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-44004 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3865 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6ff3-jgxh-vffj · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09764 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-44004 · Security Note
• https://github.com/mattermost/mattermost-plugin-confluence · Note
• https://suse.com/security/cve/CVE-2025-52931 · Note
• https://suse.com/security/cve/CVE-2025-55196 · Note
• https://suse.com/security/cve/CVE-2025-55198 · Note
• https://suse.com/security/cve/CVE-2025-54525 · Note
• https://suse.com/security/cve/CVE-2025-54478 · Note
• https://twitter.com/CVEnew/status/1954985239098323246 · Twitter Post
• https://suse.com/security/cve/CVE-2025-54458 · Note