CVE-2026-3109

EPSS 0.29%
Veröffentlicht 26.03.2026 16:28:07
Zuletzt bearbeitet 08.06.2026 12:24:28
Quelle responsibledisclosure@mattermo
CVE-Watchlists
Login
Unerledigt
Login

Missing timestamp validation in Zoom webhook handler

Mattermost Plugins versions <=11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to corrupt Zoom meeting state in Mattermost via replayed webhook requests. Mattermost Advisory ID: MMSA-2026-00584

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

NVD 1 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mattermost ≫ Mattermost Server Version >= 10.11.0 < 10.11.12

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.29%	0.206

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
responsibledisclosure@mattermost.com	2.2	0.7	1.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

CWE-754 Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

https://mattermost.com/security-updates

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-3109

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-3109

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-3109

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2026-3109