Mattermost plugins allow a webhook endpoint to process incoming requests without validating the request size. An authenticated attacker can send oversized or malformed payloads that overwhelm the service, leading to a loss of availability for all users. The vulnerability is a classic resource exhaustion weakness (CWE‑400). The impact is limited to service disruption and does not expose data or allow code execution.

Any Mattermost installation running the Zoom plugin on versions up to 11.4, 11.0.4, 11.1.3, 11.3.2, or 10.11.11.0 is affected. These versions fail to enforce request size limits, leaving the webhook endpoint open to abuse.

The CVSS score of 4.9 indicates a moderate severity. Because the attacker must be authenticated, exploitation requires legitimate access to the Mattermost instance, but a single authenticated user can trigger a denial of service that impacts all users. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, reducing immediate visibility of exploitation. Still, organizations that host Mattermost should treat this as a moderate risk due to its availability impact and the ease of sending crafted requests once authenticated.