CVE-2025-44004 — Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin

CVE-2025-44004

Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin PUBLISHED

Description (CNA)

Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost Confluence Plugin	affected 0 before 1.5.0; unaffected 1.5.0

CWE

CWE-306

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.