What is the CVSS score of EUVD-2026-16236?

EUVD-2026-16236 has a CVSS 3.1 base score of 2.2 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by EUVD-2026-16236?

CVE-2026-3109 is a low-severity vulnerability (CVSS 2.2). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

How to fix or mitigate EUVD-2026-16236?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Mattermost EUVD-2026-16236

| CVE-2026-3109 LOW

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-03-26 Mattermost

Information Disclosure Mattermost

2.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.2 LOW

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16236

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:28 nvd

LOW 2.2

DescriptionCVE.org

Mattermost Plugins versions <=11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to corrupt Zoom meeting state in Mattermost via replayed webhook requests. Mattermost Advisory ID: MMSA-2026-00584

AnalysisAI

Mattermost Plugins versions 11.4 and earlier, including 10.11.11.0, fail to validate webhook request timestamps, enabling attackers with high privileges to replay webhook requests and corrupt Zoom meeting state within Mattermost deployments. The vulnerability carries a CVSS score of 2.2 with low attack complexity but requires high-privilege authentication; no public exploit has been identified at time of analysis, and CISA has not flagged this for active exploitation.

Technical ContextAI

This vulnerability exists in Mattermost's webhook handling mechanism (CWE-754: Improper Check for Unusual or Exceptional Conditions), specifically affecting the Zoom plugin integration. Webhooks are HTTP callbacks used to notify Mattermost of external events; without timestamp validation, an attacker can replay previously captured webhook requests. The affected product is identified by CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* across versions up to 11.4. The root cause is insufficient input validation of webhook request metadata, allowing time-based attack replay even though the webhook signature itself may be authenticated. Zoom meeting state corruption indicates the replayed webhooks cause unintended state transitions in Mattermost's Zoom integration records.

RemediationAI

Upgrade Mattermost to version 11.5 or later to remediate this vulnerability; consult the official Mattermost security advisory at https://mattermost.com/security-updates for confirmed patch versions and release notes. Organizations unable to patch immediately should implement network-level controls restricting webhook source IP ranges to known, trusted Zoom infrastructure and audit webhook request logs for timestamp anomalies or duplicate event signatures. Additionally, enforce strong access controls limiting high-privilege account creation and usage, since the vulnerability requires PR:H (high-privilege authentication) to exploit effectively.