GHSA-vpcr-fqpc-386h

Source

https://github.com/advisories/GHSA-vpcr-fqpc-386h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-vpcr-fqpc-386h/GHSA-vpcr-fqpc-386h.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-vpcr-fqpc-386h

Aliases

Published

2025-08-11T21:31:38Z

Modified

2025-08-18T13:59:46Z

Severity

4.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator

Summary

Mattermost Confluence Plugin has Missing Authorization vulnerability

Details

Mattermost Confluence Plugin versions < 1.5.0 fail to check user access to the channel, which allows attackers to get channel subscription details without proper access to the channel via an API call to the Get Channel Subscriptions details endpoint.

Database specific

{
    "cwe_ids":  [
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-08-11T22:47:52Z",
    "nvd_published_at":  "2025-08-11T19:15:27Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/mattermost/mattermost-plugin-confluence

Package

Name: github.com/mattermost/mattermost-plugin-confluence; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost-plugin-confluence

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-vpcr-fqpc-386h/GHSA-vpcr-fqpc-386h.json"