Mattermost Server and the Zoom plugin contain a user‑validation flaw when the /plugins/zoom/api/v1/channel-preference endpoint is accessed. Because the authenticated user is not correctly checked, any logged‑in user can craft an API request to alter Zoom meeting restrictions for any channel. This allows an attacker to bypass channel‑level permissions and modify meeting settings that should be controlled by channel administrators, potentially disrupting communications or enabling malicious meeting configurations.

Affected installations include Mattermost Server versions 10.11.x up to 10.11.9, 11.1.x up to 11.1.2, and 11.2.x up to 11.2.1, as well as Mattermost Plugin Zoom versions up to 1.11.0.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of <1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate to Mattermost but thereafter can send crafted requests from any channel to change Zoom restrictions. There is no need for external network access beyond normal authenticated usage, so the primary requirement is an existing logged‑in account and knowledge of the vulnerable API endpoint.