PatchTheCVECVE-2025-44001: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows
CVE-2025-44001 is a medium-severity flaw (CVSS 4.0) affecting confluence. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the Get Channel Subscriptions details endpoint.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.0 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 89%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2025-08-11 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-44001?
confluence: upgrade to 1.5.0. Exact commands for each OS are on this page.
Is CVE-2025-44001 being exploited?
CVE-2025-44001 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-44001 affect?
CVE-2025-44001 affects confluence. Severity is medium (CVSS 4.0). Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the Get Channel Subscriptions d
How urgent is CVE-2025-44001?
Priority 22/100. Remotely exploitable, no login, no user action
Software pages
Atlassian Confluence vulnerabilities · Mattermost vulnerabilities
Related CVEs
- CVE-2025-8285 MEDIUM 4.0 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows
- CVE-2025-54525 HIGH 7.5 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to
- CVE-2025-54478 HIGH 7.2 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost inst
- CVE-2025-54463 MEDIUM 5.9 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to
- CVE-2025-54458 MEDIUM 5.0 UPGRADE Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space whic