PT-2026-8328 · Mattermost · Mattermost Plugin Zoom+1

Daw10

·

Publicado

2026-02-16

·

Atualizado

2026-03-03

·

CVE-2026-0997

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Mattermost versions 11.1.x through 11.1.2 Mattermost versions 10.11.x through 10.11.9 Mattermost versions 11.2.x through 11.2.1 Mattermost Plugin Zoom versions through 1.11.0
Description The Mattermost application and its Zoom plugin do not properly verify user authorization when handling requests. Specifically, the system fails to validate the authenticated user when processing requests to the /plugins/zoom/api/v1/channel-preference API endpoint. This allows any authenticated user to modify Zoom meeting restrictions for any channel by sending specially crafted API requests. The vulnerable function is not explicitly mentioned.
Recommendations Update Mattermost to a version later than 11.1.2. Update Mattermost to a version later than 10.11.9. Update Mattermost to a version later than 11.2.1. Update the Mattermost Zoom Plugin to a version later than 1.11.0.

Correção

Incorrect Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-0997
GHSA-2PHX-FRHF-XR55
GO-2026-4519
SUSE-SU-2026:0757-1

Produtos afetados

Mattermost
Mattermost Plugin Zoom