CVE-2025-53857: Mattermost Confluence Plugin has Missing Authorization vulnerability
3.7
Basic Information
GoTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost-plugin-confluence | go | < 1.5.0 | 1.5.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability described in CVE-2025-53857 is a missing authorization flaw in the Mattermost Confluence plugin, specifically mentioning the GET autocomplete/GetChannelSubscriptions endpoint. By analyzing the commits between the last vulnerable version (v1.4.0) and the patched version (v1.5.0), I identified commit 39f67d31692578dee68722c28cf60f0c28b97ab9 titled "Security review fixes" as the primary patch for this issue.
The root cause of the vulnerability is the failure to verify if the user making an API request is a member of the channel they are trying to interact with. This allowed for unauthorized access to subscription information.
The primary vulnerable function is handleGetChannelSubscriptions in server/get_subscriptions.go, which directly corresponds to the endpoint mentioned in the CVE. The patch for this function, while not as robust as fixes for other functions, confirms that a security control was missing.
Additionally, the same commit patched several other functions (handleGetChannelSubscription, handleEditChannelSubscription, handleSaveSubscription, and deleteSubscription) by adding a new, more explicit channel access check (hasChannelAccess). This indicates a systemic issue of missing authorization across multiple parts of the plugin's API that were all addressed in the security update. While the CVE description only highlights the information disclosure aspect, the patches reveal that modification and deletion of subscriptions were also possible.