Mattermost and Mattermost Plugin Zoom User Identity Validation Vulnerability in the AskPMI Endpoint

A vulnerability exists in Mattermost versions 11.1.x through 11.1.2, 10.11.x through 10.11.9, and 11.2.x through 11.2.1, as well as in Mattermost Plugin Zoom versions through 1.11.0. These versions fail to properly validate user identity and post ownership in the /api/v1/askPMI endpoint. This oversight allows unauthorized users to initiate Zoom meetings on behalf of any user and to overwrite posts by manipulating user IDs and post data in direct API calls.

Impact

Exploitation of this vulnerability allows unauthorized users to start Zoom meetings as any user and to overwrite arbitrary posts by manipulating user IDs and post data through the API.

Remediation

Users can upgrade to Mattermost versions 11.4.0 or 10.11.11. For Mattermost Plugin Zoom, version 1.11.1 is available.