CVE-2025-44004

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
MattermostMattermost Confluence Plugin< 1.5.0

References

Timeline

Published
Aug 11, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-4400510.0An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain pCVE-2025-440066.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-440076.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-440086.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-440096.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-440106.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-440116.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-440126.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-440136.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a usCVE-2025-440148.8An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then expCVE-2025-440158.4A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then eCVE-2025-440168.8A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows
CVE-2025-44004: High severity, CVSS 7.2 | Vulnix