---
id: CVE-2026-28732
title: >-
  Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3
  Fail to enforce slash command trigger-word uniqueness during command updates
  which allows an authenticated team member with Manage Own Slash Commands
  permission …
summary: >-
  Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3
  Fail to enforce slash command trigger-word uniqueness during command updates
  which allows an authenticated team member with Manage Own Slash Commands
  permission …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-863
vendor: mattermost
product: mattermost_server
affected:
  - 'mattermost_server >= 10.11.0, < 10.11.14'
  - 'mattermost_server >= 11.4.0, < 11.4.4'
  - 'mattermost_server >= 11.5.0, < 11.5.2'
patched:
  - mattermost_server 11.5.2
published: '2026-05-18'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-28732'
references:
  - url: 'https://mattermost.com/security-updates'
    label: responsibledisclosure@mattermost.com
tags:
  - nvd
epss: 0.00254
epssPercentile: 0.1579
ingestedAt: '2026-10-14T20:53:12.298Z'
---

## Overview

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash commands via editing their own slash command trigger to an already-registered trigger through the command update API. Mattermost Advisory ID: MMSA-2026-00597

## Affected

- `mattermost_server >= 10.11.0, < 10.11.14`
- `mattermost_server >= 11.4.0, < 11.4.4`
- `mattermost_server >= 11.5.0, < 11.5.2`

## Remediation

Upgrade past the affected range:

- `mattermost_server 11.5.2`