CVE-2026-0998
Authentication Bypass in Mattermost API Enables Unauthorized Zoom Meeting Control
Publication date: 2026-02-16
Last updated on: 2026-02-18
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mattermost_server | From 10.11.0 (inc) to 10.11.10 (exc) |
| mattermost | mattermost_server | From 11.2.0 (inc) to 11.2.2 (exc) |
| mattermost | mattermost_server | From 11.1.0 (inc) to 11.1.3 (exc) |
| mattermost | zoom | to 1.11.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects certain versions of Mattermost and the Mattermost Plugin Zoom. It occurs because the system fails to properly validate user identity and post ownership in the /api/v1/askPMI endpoint. As a result, unauthorized users can start Zoom meetings as any user and overwrite arbitrary posts by making direct API calls with manipulated user IDs and post data.
How can this vulnerability impact me? :
The vulnerability allows unauthorized users to impersonate any user to start Zoom meetings and to overwrite posts arbitrarily. This can lead to unauthorized access to meetings, potential disruption of communication, and manipulation or loss of posted information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know