Mattermost CVE-2026-3109

Multiple risk signals present a mixed picture. The CVSS score of 2.2 is low, and the vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L) indicates high attack complexity and high privilege requirements, limiting real-world exploitability. CISA's SSVC decision framework rates exploitation as 'none' with 'no' automatable status and only 'partial' technical impact, reinforcing the low urgency. However, the network-accessible attack vector (AV:N) and the specific nature of the flaw (replay attack) mean that an attacker who has already compromised a high-privilege account can execute this attack without additional user interaction. The absence of public exploit code and lack of KEV designation further reduce immediate risk. This is a legitimate but low-priority security issue appropriate for regular patching cycles rather than emergency response.

An attacker with compromised high-privilege credentials (e.g., workspace admin account) captures a legitimate Zoom webhook request containing meeting state information. The attacker later replays this same webhook request to Mattermost multiple times, and because the application does not validate the request timestamp, Mattermost processes it again, causing the Zoom meeting state to become corrupted or desynchronized. This could result in users seeing stale meeting information or incorrect meeting status, though with limited real-world impact due to the high-privilege requirement and high attack complexity (AC:H) of establishing and maintaining a compromised admin account.