7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-44004

CVE-2025-44004: Mattermost Confluence Plugin is Missing Authentication for Critical Function

Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-44004

CVE-2025-44004:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-plugin-confluence	go	< 1.5.0	1.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-44004) in the Mattermost Confluence Plugin (< 1.5.0) is a classic 'Missing Authentication for Critical Function' (CWE-306). The core of the issue lies in the API endpoints responsible for managing channel subscriptions. These endpoints failed to verify if the user making the request was authenticated with the Mattermost instance.

The patch, found in commit de0a3d4c9eefa013e7d9f7a18d82eeced63322e6, addresses this by introducing a centralized authentication check. A new boolean field, IsAuthenticated, was added to the Endpoint struct. When this flag is set to true for a specific API endpoint, a new checkAuth middleware is invoked. This middleware verifies the presence of the Mattermost-User-Id header in the request, effectively ensuring that only authenticated users can access these sensitive endpoints.

The analysis of the patch reveals that several handlers were missing this check. The most critical of these is handleSaveSubscription, which maps to the API endpoint for creating new subscriptions, directly corresponding to the vulnerability description. Other functions for editing (handleEditChannelSubscription) and viewing (handleGetChannelSubscription, handleGetChannelSubscriptions) subscriptions were also left unprotected and were fixed in the same commit. An attacker could have sent a crafted HTTP request to these API endpoints to create, edit, or view channel subscriptions without any valid session or credentials.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.