Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin

Vulnerability Description

The Mattermost Confluence Plugin versions prior to 1.5.0 fail to verify the authorization of the user making API calls to the create channel subscription endpoint [1]. This missing authorization check allows any attacker who can reach the API to create subscriptions without proper authentication or permissions.

Exploitation

An attacker can exploit this by sending a crafted API request to the create channel subscription endpoint. No prior authentication or special privileges on the Mattermost instance are required [1]. The plugin does not validate whether the requester has the right to create subscriptions, enabling unauthorized creation.

Impact

Successful exploitation allows an attacker to create channel subscriptions that link Confluence events to Mattermost channels. This could lead to unauthorized disclosure of Confluence activity, such as page updates or comments, to unintended channels [2]. The attacker may also disrupt existing subscription configurations.

Mitigation

Users should upgrade to Mattermost Confluence Plugin version 1.5.0 or later, which includes the necessary authorization checks [1]. No workaround is documented. Mattermost recommends following their security updates page for future advisories [3].