CVE-2026-3109

Published: Mar 26, 2026Modified: Mar 30, 2026

2.2

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

Exploitability: 0.7 / Impact: 1.4

Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost Plugins versions <=11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to corrupt Zoom meeting state in Mattermost via replayed webhook requests. Mattermost Advisory ID: MMSA-2026-00584

Related CWEs

CWE-754

Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

References (1)

https://mattermost.com/security-updates

Source: responsibledisclosure@mattermost.com

Timeline

No history available yet.