Mattermost Confluence Plugin is Missing Authentication for Critical Function

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-44004 · ADVISORY
• mattermost/mattermost-plugin-confluence · PACKAGE
• mattermost.com/security-updates · WEB
• GitHub Advisory GHSA-6ff3-jgxh-vffj · ADVISORY

Mais vulnerabilidades de github.com/mattermost/mattermost-plugin-confluence

• CVE-2025-13523MÉDIO 5.4Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows a…
• CVE-2025-8285MÉDIO 5.3Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel su…
• CVE-2025-54525ALTO 7.5Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant …
• CVE-2025-54478MÉDIO 5.3Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthentica…
• CVE-2025-54463ALTO 7.5Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant …