Executive brief
Mattermost, a collaboration and messaging platform, contains a vulnerability where it fails to ensure that 'slash command' trigger words are unique when they are updated. This allows an authorized team member to modify their own custom commands to use the same trigger word as an existing system or custom command. By doing so, they can effectively hijack or impersonate legitimate commands, potentially misleading other users or intercepting command-based workflows.
Technical details
An incorrect authorization and validation flaw (CWE-863) exists in Mattermost's command update API. While the system typically prevents duplicate trigger words during initial command creation, it fails to perform the same uniqueness check when a command is edited. An authenticated attacker with 'Manage Own Slash Commands' permissions can update their own command's trigger word to match an existing one (e.g., a system command or another user's custom command). This results in a command collision where the attacker's command can intercept or impersonate the intended functionality. The vulnerability is addressed in versions 11.5.2, 11.4.4, and 10.11.14.
Affected products
- Mattermost Mattermost Server 11.5.0 - 11.5.1, 11.4.0 - 11.4.3, 10.11.0 - 10.11.13, and versions prior to 8.0.0-20260306123948-f5fe8ded6b63
Timeline
- 2026-03-06: patched: Fix committed to source repository
- 2026-05-18: disclosed: NVD and GitHub Advisory published