CVE-2026-3109: Mattermost Plugins timestamp validation failure in Zoom webhook

CVE-2026-3109 · Severity: low · CVSS 2.2 · Published 2026-03-26

A vulnerability in Mattermost plugins allows an attacker to interfere with Zoom meeting statuses within the Mattermost platform. By capturing and re-sending old notification data, an attacker could cause the system to display incorrect meeting information. This issue primarily impacts the reliability of meeting state tracking rather than sensitive user data.

Technologies: Mattermost Plugins, Mattermost Server. Vendors: Mattermost.

Quick answers

Is CVE-2026-3109 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-3109 being exploited in the wild.
How severe is CVE-2026-3109?
Low severity, with a CVSS score of 2.2, published 26 March 2026.
Which products and versions are affected?
Mattermost Plugins <= 11.4; Mattermost Server 10.11.0 - 10.11.11.0.
Is there a fix for CVE-2026-3109?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-3109 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-3109?
Check whether you run Mattermost Plugins or Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as an improper check for unusual conditions (CWE-754) specifically related to missing timestamp validation in webhook requests. In Mattermost Plugins versions up to 11.4 and Mattermost Server versions 10.11.0 through 10.11.11.0, the system does not verify the freshness of incoming webhooks. A remote attacker with high privileges can capture legitimate webhook traffic and replay it to the server. This results in the corruption of Zoom meeting states within the Mattermost interface, leading to a localized loss of availability or integrity regarding meeting status. The attack requires high privileges and specific timing (high attack complexity).

Affected products

  • Mattermost Mattermost Server 10.11.0 - 10.11.11.0
  • Mattermost Mattermost Plugins <= 11.4

Timeline

  • 2026-03-26: disclosed
  • 2026-03-26: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.