CVE-2026-0997: 
NixOS vulnerability analysis and mitigation

CVE-2026-0997 is an incorrect authorization vulnerability in Mattermost Server and the Mattermost Plugin Zoom that allows any authenticated user to modify Zoom meeting restrictions for arbitrary channels. The flaw exists in Mattermost Server versions 10.11.x (≤10.11.9), 11.1.x (≤11.1.2), and 11.2.x (≤11.2.1), as well as Mattermost Plugin Zoom versions ≤1.11.0. It was published on February 16, 2026, with patches added on February 18, 2026, and is tracked under Mattermost Advisory ID MMSA-2025-00558. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, Mattermost Security).

The root cause is an incorrect authorization check (CWE-863) in the Zoom plugin's channel preference API endpoint (/plugins/zoom/api/v1/channel-preference). When processing requests to this endpoint, the application fails to verify whether the authenticated user has the necessary permissions to manage the target channel, allowing any logged-in user to submit crafted API requests that alter Zoom meeting restrictions for channels they do not own or administer. Exploitation requires only a valid session (low-privilege authenticated access) and no user interaction, making it straightforward to abuse via direct HTTP requests (Red Hat CVE, Mattermost Security).

Successful exploitation allows any authenticated user to modify Zoom meeting restrictions — such as disabling recordings, changing participant restrictions, or altering meeting settings — for arbitrary channels across the organization without proper authorization. The impact is limited to integrity of meeting configurations; there is no confidentiality or availability impact. While lateral movement is not applicable, the vulnerability could be used to disrupt or manipulate meeting governance policies organization-wide (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.026%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the low barrier to exploitation — requiring only a valid authenticated session and a crafted API request — means any internal user could trivially abuse it (Red Hat CVE, Mattermost Security).

1. Authentication: Log in to the target Mattermost instance with any valid user account (no elevated privileges required).
2. Identify target channel: Enumerate available channels using the Mattermost API or UI to identify a channel whose Zoom meeting restrictions the attacker wishes to modify.
3. Craft malicious API request: Construct an HTTP request targeting the vulnerable endpoint, e.g.:

   POST /plugins/zoom/api/v1/channel-preference
   Authorization: Bearer <attacker_session_token>
   Content-Type: application/json
   
   {"channel_id": "<target_channel_id>", "preference": {"<setting>": "<value>"}}

4. Submit request: Send the crafted request to the Mattermost server. Because the endpoint does not validate whether the authenticated user has channel management permissions, the server processes the request and applies the configuration change.
5. Verify impact: Confirm that Zoom meeting restrictions for the target channel have been altered, such as disabling recording requirements or changing participant controls (Red Hat CVE).

• Network: Unexpected or repeated HTTP POST requests to /plugins/zoom/api/v1/channel-preference from user accounts that are not channel administrators or owners.
• Logs: Mattermost server access logs showing API calls to the Zoom plugin channel preference endpoint from low-privilege user tokens across multiple channel IDs in a short time window.
• Application: Audit log entries reflecting changes to Zoom meeting restrictions on channels where the acting user is not a member with management rights; sudden or unexplained changes to Zoom meeting settings across multiple channels.

Organizations should upgrade to the following patched versions immediately: Mattermost Server 10.11.10, 11.1.3, or 11.2.2 (depending on the deployed branch), and Mattermost Plugin Zoom version 1.11.1 or later. As interim measures, consider restricting network-level access to the Mattermost instance and auditing API logs for suspicious calls to the Zoom plugin endpoint. Review channel configurations to identify and revert any unauthorized changes to Zoom meeting restrictions (Mattermost Security, Red Hat CVE).

Coverage of this vulnerability has been limited to standard security aggregators and advisory databases. A brief technical write-up was published by Infinit Security shortly after disclosure (Infinit Security). No notable researcher commentary or significant social media discussion has been identified beyond routine CVE tracking.