PT-2026-8328 · Mattermost · Mattermost Plugin Zoom+1

Daw10

·

Published

2026-02-16

·

Updated

2026-03-03

·

CVE-2026-0997

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Mattermost versions 11.1.x through 11.1.2 Mattermost versions 10.11.x through 10.11.9 Mattermost versions 11.2.x through 11.2.1 Mattermost Plugin Zoom versions through 1.11.0
Description The Mattermost application and its Zoom plugin do not properly verify user authorization when handling requests. Specifically, the system fails to validate the authenticated user when processing requests to the /plugins/zoom/api/v1/channel-preference API endpoint. This allows any authenticated user to modify Zoom meeting restrictions for any channel by sending specially crafted API requests. The vulnerable function is not explicitly mentioned.
Recommendations Update Mattermost to a version later than 11.1.2. Update Mattermost to a version later than 10.11.9. Update Mattermost to a version later than 11.2.1. Update the Mattermost Zoom Plugin to a version later than 1.11.0.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-0997
GHSA-2PHX-FRHF-XR55
GO-2026-4519
SUSE-SU-2026:0757-1

Affected Products

Mattermost
Mattermost Plugin Zoom