The vulnerability arises from a missing validation of timestamps in the Zoom webhook handler of Mattermost Plugins. Since the plugin does not verify that incoming webhook messages are fresh, an attacker can replay old requests, which in turn can manipulate the state of Zoom meetings integrated within Mattermost, potentially leading to unauthorized configuration changes or disabling of meetings. The weakness is categorized as CWE‑754.

Mattermost Plugins versions 11.4 and earlier, and 10.11.11.0 and earlier, are impacted. This flaw applies specifically to the Zoom integration component that handles webhook callbacks, allowing attackers to abuse replayed webhook requests on affected servers.

The CVSS score of 2.2 indicates a low severity under normal circumstances, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation would require an attacker to send replayed webhook requests to the vulnerable Mattermost instance, typically over the Internet via the Zoom API. The most likely attack vector is remote web traffic targeting the Zoom webhook endpoint, and the presence of no EPSS score suggests low current exploit activity. Overall, while the impact to a single meeting is limited, the ability to repeatedly manipulate meeting state poses a moderate operational risk.