PT-2026-28420 · Mattermost+1 · Mattermost Plugins+1

Thecybertantrik · Published 2026-03-26 · Updated 2026-06-08 · CVE-2026-3109

Positive Technologies (AI Summary)

CVSS v3.1

2.2

Low

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mattermost Plugins versions 10.11.11.0 and 11.4

Description Mattermost plugins do not properly validate timestamps in webhook requests. This allows an attacker to repeatedly send webhook requests, potentially corrupting the state of Zoom meetings within Mattermost. The issue involves the replay of webhook requests.

Recommendations Update Mattermost Plugins to a version newer than 11.4. Update Mattermost Plugins to a version newer than 10.11.11.0.

Fix

DoS

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2026-3109

Affected Products

Mattermost Plugins

Zoom

References · 7

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3109 · Security Note
• https://twitter.com/CVEnew/status/2037513440915271835 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2037263499533922371 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3109 · Note
• https://twitter.com/infoflowcloud/status/2037515602835701924 · Twitter Post
• https://twitter.com/dailycve/status/2063973480828145909 · Twitter Post