Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint which allows unauthorized users to start Zoom meetings as any user and overwrite arbitrary posts via direct API calls with manipulated user IDs and post data.. Mattermost Advisory ID: MMSA-2025-00534
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-0998 Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate user identity and post ownershi… https://www.cve.org/CVERecord?id=CVE-2026-0998
Post summary
CVE‑2026‑0998 exposes identity validation failures in certain Mattermost and Zoom plugin versions, risking unauthorized post ownership.
CVE-2026-0998 Mattermost Zoom Plugin Unauthorized Meeting Initiation and Post Modification Vulnerability https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-0998
Post summary
The text announces CVE‑2026‑0998 as a vulnerability in Mattermost’s Zoom plugin that allows unauthorized meeting initiation and post modification, but it contains no PoC, exploit, or patch details.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mattermost | mattermost_server | - | - | - |
| App | mattermost | zoom | - | mattermost | - |