3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49221

CVE-2025-49221: Mattermost Confluence Plugin has Missing Authorization vulnerability

Mattermost Confluence Plugin versions < 1.5.0 fail to enforce authentication of the user to the Mattermost instance, which allows unauthenticated attackers to access subscription details via an API call to the GET subscription endpoint.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49221

CVE-2025-49221:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-plugin-confluence	go	< 1.5.0	1.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis identified a missing authorization flaw in the Mattermost Confluence plugin, specifically affecting the endpoint that retrieves subscription details. The vulnerability, as described, allows an unauthenticated attacker to access this information.

To pinpoint the vulnerable functions, I first identified the code changes between the last vulnerable version (v1.4.0) and the first patched version (v1.5.0). The commit de0a3d4c9eefa013e7d9f7a18d82eeced63322e6, with the message "Add API authentication and panic handling in server webhook process", was identified as the primary security patch.

Analysis of this commit revealed the following key changes:

A new boolean field, IsAuthenticated, was added to the Endpoint struct in server/controller.go.
The InitAPI function in server/controller.go was updated to use a new checkAuth middleware for any endpoint where IsAuthenticated is set to true.
The checkAuth middleware enforces authentication by checking for the presence of the Mattermost-User-Id header.
Crucially, the getChannelSubscription endpoint definition in server/get_subscription.go, which handles requests to GET /api/v1/{channelID}/subscription, had its IsAuthenticated flag set to true. This directly addresses the vulnerability.

The primary vulnerable function is handleGetChannelSubscription because, prior to the patch, it was executed without any authentication check, exposing sensitive subscription data. The InitAPI function is also included as it's the component responsible for routing requests to the handlers, and its modification was essential for applying the fix across multiple endpoints.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.