CVE-2026-0997: Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels

February 16, 2026 (updated February 19, 2026)

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate the authenticated user when processing {{/plugins/zoom/api/v1/channel-preference}}, which allows any logged-in user to change Zoom meeting restrictions for arbitrary channels via crafted API requests.. Mattermost Advisory ID: MMSA-2025-00558

References

github.com/advisories/GHSA-2phx-frhf-xr55
github.com/mattermost/mattermost-plugin-zoom
github.com/mattermost/mattermost-plugin-zoom/commit/a8b58c43625ab25746e451acc4f71515d52c8122
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-0997

Code Behaviors & Features

Detect and mitigate CVE-2026-0997 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →