Executive brief
A vulnerability in Mattermost plugins allows an attacker to interfere with Zoom meeting statuses within the Mattermost platform. By capturing and re-sending old notification data, an attacker could cause the system to display incorrect meeting information. This issue primarily impacts the reliability of meeting state tracking rather than sensitive user data.
Technical details
The vulnerability is classified as an improper check for unusual conditions (CWE-754) specifically related to missing timestamp validation in webhook requests. In Mattermost Plugins versions up to 11.4 and Mattermost Server versions 10.11.0 through 10.11.11.0, the system does not verify the freshness of incoming webhooks. A remote attacker with high privileges can capture legitimate webhook traffic and replay it to the server. This results in the corruption of Zoom meeting states within the Mattermost interface, leading to a localized loss of availability or integrity regarding meeting status. The attack requires high privileges and specific timing (high attack complexity).
Affected products
- Mattermost Mattermost Server 10.11.0 - 10.11.11.0
- Mattermost Mattermost Plugins <= 11.4
Timeline
- 2026-03-26: disclosed
- 2026-03-26: advisory