CVE-2025-53910: Mattermost Confluence Plugin has Missing Authorization vulnerability
4
Basic Information
GoTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost-plugin-confluence | go | < 1.5.0 | 1.5.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability, described as a missing authorization issue, allowed users to create or edit channel subscriptions in the Mattermost Confluence Plugin without being a member of the respective channel. The analysis of the commits between the vulnerable version (v1.4.0) and the patched version (v1.5.0) revealed that the root cause was the absence of a channel access check in the API handlers responsible for managing subscriptions.
The primary fix was introduced in commit 39f67d31692578dee68722c28cf60f0c28b97ab9. This commit added a call to a new function, hasChannelAccess, within handleEditChannelSubscription (in server/edit_subscription.go) and handleSaveSubscription (in server/save_subscription.go). This check ensures that the user making the request is a member of the channel before allowing them to create or edit a subscription.
Other related commits introduced further security enhancements, such as requiring authentication for all API endpoints and restricting certain actions to system administrators. However, the core vulnerability of missing channel-level authorization was addressed by the introduction of the hasChannelAccess check in the aforementioned functions. Therefore, handleEditChannelSubscription and handleSaveSubscription are the identified vulnerable functions that would appear in a runtime profile during exploitation.