CVE-2026-0998: Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controls
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint which allows unauthorized users to start Zoom meetings as any user and overwrite arbitrary posts via direct API calls with manipulated user IDs and post data.. Mattermost Advisory ID: MMSA-2025-00534
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0998?
CVE-2026-0998 has been classified as a high severity vulnerability due to its potential impact on user data security.
How do I fix CVE-2026-0998?
To fix CVE-2026-0998, update Mattermost to version 11.1.3 or higher, 10.11.10 or higher, or 11.2.2 or higher, and update the Mattermost Plugin Zoom to version 1.11.1 or higher.
What systems are affected by CVE-2026-0998?
CVE-2026-0998 affects Mattermost versions 11.1.x up to 11.1.2, 10.11.x up to 10.11.9, 11.2.x up to 11.2.1, and Mattermost Plugin Zoom versions up to 1.11.0.
What are the risks of not mitigating CVE-2026-0998?
Failing to mitigate CVE-2026-0998 may allow unauthorized users to create meetings and modify posts, compromising sensitive information.
How can I confirm if my installation is vulnerable to CVE-2026-0998?
Verify your Mattermost and Mattermost Plugin Zoom versions against the affected versions listed in the CVE-2026-0998 report.