Mattermost Confluence Plugin Access Control Vulnerability in Subscription Editing

A vulnerability exists in the Mattermost Confluence Plugin, specifically in versions prior to 1.5.0. The issue arises because the plugin fails to properly verify user access to Confluence spaces. This oversight allows attackers to manipulate subscriptions for spaces they do not have permission to access, by exploiting the edit subscription endpoint.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of Confluence space subscriptions, allowing attackers to interfere with subscription management processes.

Remediation

Users can upgrade to Mattermost Confluence Plugin version 1.5.0 or later to address this vulnerability.