Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin

The Mattermost Confluence Plugin version prior to 1.5.0 contains an authentication bypass vulnerability in the API endpoint that handles editing channel subscriptions. The plugin fails to verify that the user making the API call is authenticated to the Mattermost instance, thus allowing any unauthenticated actor to invoke the edit subscription functionality [1].

Exploitation

An attacker can exploit this flaw by sending a crafted API request directly to the edit channel subscription endpoint without needing to provide valid session credentials or authentication tokens. No prior access to the Mattermost instance or Confluence is required, making the attack surface broad and easily reachable over the network [1].

Impact

Successful exploitation enables an unauthenticated attacker to modify existing channel subscriptions within the plugin's integration. This could lead to unauthorized changes in how notifications and content are delivered between Confluence and Mattermost, potentially disrupting workflows or exposing sensitive information to unintended channels [1].

Mitigation

Users are advised to upgrade to Mattermost Confluence Plugin version 1.5.0 or later, which enforces proper authentication checks for the affected endpoint. Mattermost regularly publishes security updates and encourages responsible disclosure through their security update page [2].