Mattermost Confluence Plugin Channel Subscription Access Control Vulnerability

A vulnerability exists in the Mattermost Confluence Plugin versions prior to 1.5.0, where the plugin fails to properly verify user access to channels. This oversight allows attackers to create channel subscriptions via an API call to the edit channel subscription endpoint, even without the necessary permissions for the channel.

Impact

Exploitation of this vulnerability allows for unauthorized channel subscriptions to be created, potentially leading to unauthorized access to channel content or discussions.

Remediation

Users can upgrade to Mattermost Confluence Plugin version 1.5.0 or later to address this vulnerability.