4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-8285

CVE-2025-8285: Mattermost Confluence Plugin has Missing Authorization vulnerability

Mattermost Confluence Plugin versions < 1.5.0 fail to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endpoint.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-8285

CVE-2025-8285:

4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-plugin-confluence	go	< 1.5.0	1.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-8285, is a missing authorization issue in the Mattermost Confluence Plugin. The core of the problem lies in the API endpoints that handle channel subscriptions. My analysis of the commits between the vulnerable version (v1.4.0) and the patched version (v1.5.0) reveals that the plugin failed to properly verify a user's permissions before creating, editing, or viewing subscriptions.

The primary vulnerable functions were handleSaveSubscription and handleEditChannelSubscription. Before the patch, these functions only checked if the user making the request had a linked Confluence account. They did not perform the critical step of checking if that user had access rights to the specific Confluence space or page for the subscription. This allowed any authenticated Mattermost user to create a subscription for any channel they were in to any Confluence space or page, even private ones, simply by knowing its key or ID. This would cause the plugin to post notifications from the restricted space/page into the Mattermost channel, leaking potentially sensitive information.

The patch introduced a new function, validateUserConfluenceAccess, which is now called from both handleSaveSubscription and handleEditChannelSubscription. This new function uses the user's actual Confluence credentials to make an API call to Confluence and verify that the user has permission to access the resource before the subscription is created or modified.

Additionally, a related flaw was fixed in the handleGetChannelSubscription function, which was accepting the user ID from the URL path, allowing potential information disclosure about other users' subscriptions. The fix ensures the user ID is taken from the secure request header.

In summary, the root cause was a failure to enforce resource-level permissions, allowing users to bypass Confluence's access controls through the Mattermost plugin's subscription API.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.