← Back

CVE-2026-3109

nvd nist
Published: Mar 26, 2026Modified: Jun 17, 2026

JSON object

Loading...
2.2
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Exploitability: 0.7 / Impact: 1.4
Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost Plugins versions <=11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to corrupt Zoom meeting state in Mattermost via replayed webhook requests. Mattermost Advisory ID: MMSA-2026-00584

Affected (1)

Mattermost
1 product
Mattermost Server
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost Server
From 10.11.0 to 10.11.12

Related CWEs

CWE-754
Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

References (1)

Source: responsibledisclosure@mattermost.com
Vendor Advisory

Timeline

No history available yet.