Webhook Validation Flaw in Mattermost Affects Plugin Functionality
CVE-2026-3109

2.2LOW

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
26 March 2026

What is CVE-2026-3109?

A vulnerability in Mattermost Plugins versions up to 11.4 and 10.11.11.0 is identified, which fails to properly validate the timestamps of webhook requests. This oversight can be exploited by attackers to send replayed webhook requests and manipulate the state of Zoom meetings within the Mattermost platform. Such exploitation has the potential to disrupt communication and collaboration workflows for users relying on the integration of these services.

Affected Version(s)

Mattermost 0 <= 10.11.11

Mattermost 11.5.0

Mattermost 10.11.12

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
2.2
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

thecybertantrik
.