CVE-2026-0997
📋 TL;DR
This vulnerability allows any authenticated Mattermost user to modify Zoom meeting restrictions for any channel via API requests. Affected systems include Mattermost versions 11.1.x up to 11.1.2, 10.11.x up to 10.11.9, 11.2.x up to 11.2.1, and Mattermost Plugin Zoom versions up to 1.11.0.
💻 Affected Systems
- Mattermost
- Mattermost Plugin Zoom
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Zoom by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Malicious insider or compromised account could disrupt Zoom meeting functionality across all channels, potentially interfering with business communications and collaboration.
Likely Case
Unauthorized modification of Zoom meeting settings for specific channels, causing confusion or minor disruption to team communications.
If Mitigated
Limited impact with proper access controls and monitoring, as exploitation requires authenticated access.
🎯 Exploit Status
Exploitation requires authenticated access to Mattermost. The vulnerability is in authorization validation logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Mattermost: 11.1.3, 10.11.10, 11.2.2; Mattermost Plugin Zoom: 1.11.1
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Update Mattermost to patched versions: 11.1.3, 10.11.10, or 11.2.2. 2. Update Mattermost Plugin Zoom to version 1.11.1 or later. 3. Restart Mattermost service after updates.
🔧 Temporary Workarounds
Disable Zoom Plugin
allTemporarily disable the Zoom plugin to prevent exploitation of the vulnerable endpoint.
mmctl plugin disable zoom
Restrict API Access
allImplement network-level restrictions to limit access to the vulnerable API endpoint.
🧯 If You Can't Patch
- Implement strict access controls and monitor for unusual API requests to /plugins/zoom/api/v1/channel-preference
- Disable the Zoom plugin entirely until patching is possible
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via web interface Admin Console > System Console > About, or run: mmctl versionCheck Version:
mmctl versionVerify Fix Applied:
Verify Mattermost version is 11.1.3, 10.11.10, 11.2.2 or later, and Zoom plugin is 1.11.1 or later.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /plugins/zoom/api/v1/channel-preference from non-admin users
- Multiple failed authorization attempts for Zoom plugin endpoints
Network Indicators:
- Unusual API traffic patterns to Zoom plugin endpoints
- Requests to channel-preference endpoint from unexpected user accounts
SIEM Query:
source="mattermost" AND (uri_path="/plugins/zoom/api/v1/channel-preference" AND http_method="POST")