Unauthorized Channel Subscription Read in Mattermost Confluence Plugin

Vulnerability

Description CVE-2025-44001 affects the Mattermost Confluence Plugin versions prior to 1.5.0. The plugin fails to verify that the requesting user has proper access to a channel when processing API calls to the Get Channel Subscriptions endpoint. This oversight allows an attacker to obtain details about channel subscriptions without being a member of the target channel [1].

Exploitation

Prerequisites The attack is performed through API calls, likely requiring an authenticated user session but no special privileges beyond being able to communicate with the Mattermost instance. The vulnerability exposes subscription metadata, which includes information about which channels are subscribed to which Confluence events [2]. No user interaction is needed beyond the attacker sending the malicious request.

Impact

An attacker can enumerate channel subscriptions across the system, revealing which channels receive Confluence updates. This information leakage could aid in reconnaissance, such as identifying high-value channels or understanding team structures. The confidentiality of subscription details is compromised, though no direct modification or data alteration is possible through this vulnerability.

Mitigation

The issue is fixed in Mattermost Confluence Plugin version 1.5.0. Users should upgrade to this version or later. There is no evidence of active exploitation or inclusion in CISA's Known Exploited Vulnerabilities catalog as of the publication date. The Mattermost security updates page [3] provides general guidance for addressing security issues.