EUVD-2026-30760
GHSA-wvcv-9xpm-7mqc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash commands via editing their own slash command trigger to an already-registered trigger through the command update API. Mattermost Advisory ID: MMSA-2026-00597
AnalysisAI
Authenticated team members with 'Manage Own Slash Commands' permission can hijack existing slash commands in Mattermost 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3 by editing their own command triggers to match already-registered system or custom commands. This privilege escalation flaw (CWE-863: Incorrect Authorization) enables command impersonation, allowing attackers to intercept and potentially manipulate user interactions with legitimate slash commands. With CVSS 4.3 (low-medium severity) and EPSS data unavailable, real-world risk depends heavily on organizational use of slash commands for sensitive operations. No public exploit identified at time of analysis, and the attack requires authenticated access with specific permissions, limiting immediate exposure compared to unauthenticated network vulnerabilities.
Technical ContextAI
Mattermost is an open-source team collaboration platform supporting custom integrations via slash commands - user-triggered actions prefixed with forward slashes (e.g., '/remind', '/deploy'). The command update API (used when users modify their own slash commands) fails to validate trigger-word uniqueness against the global command registry. This violates authorization logic (CWE-863: Incorrect Authorization) by allowing users with 'Manage Own Slash Commands' permission to overwrite trigger words belonging to system-level or other users' commands. The vulnerability exists in the command update code path specifically - initial command creation may properly enforce uniqueness, but subsequent edits bypass this check. Affected CPE 2.3:a:mattermost:mattermost:*:*:*:*:*:* spans three concurrent release branches (10.11.x, 11.4.x, 11.5.x), suggesting the flaw was introduced in shared upstream code predating the 10.11 series and persisted through multiple major versions.
RemediationAI
Upgrade to patched Mattermost versions released after 11.5.1, 10.11.13, and 11.4.3 respectively for each affected branch - consult Mattermost Security Advisory MMSA-2026-00597 at https://mattermost.com/security-updates for exact fixed version numbers, which were not provided in NVD data at time of analysis. Organizations unable to immediately patch should implement compensating controls: (1) Audit and restrict the 'Manage Own Slash Commands' permission to only highly trusted users via System Console > User Management > Permissions, accepting trade-off of reduced self-service command management; (2) Monitor command modification events via audit logs (if available in your Mattermost edition) to detect suspicious trigger-word changes matching existing system commands; (3) Document all critical system slash command triggers and periodically verify they remain owned by authorized service accounts, not regular users - this manual verification adds operational overhead but detects hijacking attempts post-exploitation. For high-risk environments using commands for privileged operations, consider temporarily disabling custom slash command creation/editing until patching completes, though this breaks legitimate workflows. Administrative review of existing slash commands for duplicate triggers should be performed immediately to identify already-compromised commands.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today