CVE-2025-44001

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the Get Channel Subscriptions details endpoint.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-440026.1Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-adCVE-2025-440034.3Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to tCVE-2025-440047.2Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers tCVE-2025-4400510.0An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain pCVE-2025-440066.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-440076.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-440086.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-440096.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-440106.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-440116.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-440126.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-440136.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a us
CVE-2025-44001: Medium severity, CVSS 4.0 | Vulnix