What is GHSA-vpcr-fqpc-386h?

GHSA-vpcr-fqpc-386h is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost Confluence Plugin has Missing Authorization vulnerability

Which CVE IDs does GHSA-vpcr-fqpc-386h cover?

GHSA-vpcr-fqpc-386h covers the following CVE IDs: CVE-2025-44001. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vpcr-fqpc-386h?

GHSA-vpcr-fqpc-386h has a CVSS v3 base score of 4.0, published by GitHub Security Advisories.

Which products are affected by GHSA-vpcr-fqpc-386h?

GHSA-vpcr-fqpc-386h affects 1 product, including: go/github.com/mattermost/mattermost-plugin-confluence:\u003c 1.5.0.

GHSA-vpcr-fqpc-386hMediumCVSS 4.0

Mattermost Confluence Plugin has Missing Authorization vulnerability

Vendor

GitHub Security Advisories

Published

August 11, 2025

Last Modified

August 11, 2025

🔗 CVE IDs covered (1)

CVE-2025-44001 →

📋 Description

Mattermost Confluence Plugin versions < 1.5.0 fail to check user access to the channel, which allows attackers to get channel subscription details without proper access to the channel via an API call to the Get Channel Subscriptions details endpoint.

🎯 Affected products1

go/github.com/mattermost/mattermost-plugin-confluence:< 1.5.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-44001
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-vpcr-fqpc-386h