CVE-2025-44001
BaseFortify
Publication date: 2025-08-11
Last updated on: 2025-09-25
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | confluence | to 1.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of channel subscription details, potentially exposing sensitive information about who is subscribed to certain channels. Although it does not allow modification or deletion of data, this information leak could be used for further targeted attacks or social engineering.
Can you explain this vulnerability to me?
This vulnerability exists in Mattermost Confluence Plugin versions before 1.5.0, where the plugin fails to verify if a user has access to a channel before allowing them to retrieve channel subscription details via an API call. This means attackers can obtain subscription information for channels they do not have permission to access.