CVE-2026-3109 LOW

CVE-2026-3109: Missing timestamp validation in Zoom webhook handler

Vendor Mattermost

Product Mattermost

Weakness CWE-754

Published March 26, 2026

Last update March 26, 2026

View on NVD All CVEs

CVSS base score

2.2/10

Attack vector Network

Attack complexity High

Privileges required High

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

Mattermost Plugins versions <=11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to corrupt Zoom meeting state in Mattermost via replayed webhook requests. Mattermost Advisory ID: MMSA-2026-00584

Key dates

02Disclosure timeline

March 26, 2026 CVE published

March 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-3109 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/754.html

Related vulnerabilities

04Related CVE

CVE-2022-32749 Apache Traffic Server: Improperly handled requests can cause crashes in specific plugins CVE-2026-0262 PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing CVE-2021-37862 CVE-2026-42349 Clerk: Authorization bypass when combining organization, billing, or reverification checks CVE-2021-0236 Junos OS: A specific BGP VPNv6 flowspec message causes routing protocol daemon (rpd) process to crash with a core.