CVE-2026-28732: Mattermost Server Auth Bypass Vulnerability

CVE-2026-28732 Overview

CVE-2026-28732 is an authorization flaw [CWE-863] in Mattermost Server affecting versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, and 11.4.x <= 11.4.3. The server fails to enforce slash command trigger-word uniqueness during command updates. An authenticated team member with the Manage Own Slash Commands permission can edit their own slash command trigger to match an already-registered trigger. This allows hijacking and impersonation of existing system or custom slash commands through the command update API. Mattermost tracks this issue as advisory MMSA-2026-00597.

Critical Impact
An authenticated low-privileged user can impersonate trusted slash commands, redirecting user input to attacker-controlled webhooks and enabling social engineering or data interception within team workspaces.

Affected Products

Mattermost Server 11.5.x through 11.5.1
Mattermost Server 11.4.x through 11.4.3
Mattermost Server 10.11.x through 10.11.13

Discovery Timeline

2026-05-18 - CVE-2026-28732 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-28732

Vulnerability Analysis

Mattermost slash commands are user-defined integrations triggered by typing a keyword such as /deploy or /incident in a channel. Each trigger word must be unique across a workspace so that the server can route command invocations to the correct integration endpoint. The server enforces this uniqueness when a command is created, but fails to apply the same validation during update operations. This authorization and validation gap permits a team member with the Manage Own Slash Commands permission to overwrite the trigger of their own command with a trigger already registered by another integration or system command.

Root Cause

The root cause is missing uniqueness validation in the command update path. The create handler checks whether a trigger is already registered, while the update handler does not perform an equivalent check against existing triggers owned by other users or system commands. This is a classic incorrect authorization pattern under [CWE-863], where access decisions and integrity checks at one entry point are not consistently applied at another.

Attack Vector

The attacker must be authenticated to the Mattermost workspace and must hold the Manage Own Slash Commands permission, which is granted by default to most team members. The attacker creates a benign slash command with a unique trigger, then issues an update request through the command update API to change the trigger to an existing one such as a system integration or a privileged custom command. Once the trigger is hijacked, invocations of that trigger can be routed to the attacker's webhook URL, exposing user-supplied arguments and enabling impersonation of trusted automations.

No verified public proof-of-concept code is available. See the Mattermost Security Updates advisory for further technical details.

Detection Methods for CVE-2026-28732

Indicators of Compromise

Audit log entries showing PUT /api/v4/commands/{command_id} requests where the trigger field changes to a value already used by another command.
Slash command invocations producing unexpected responses, missing expected formatting, or routing to unfamiliar external URLs.
Multiple registered slash commands sharing the same trigger word across different owners after an update event.

Detection Strategies

Query the Commands database table for duplicate Trigger values grouped by TeamId to identify hijacked triggers.
Correlate Mattermost audit logs for slash command update events with subsequent command invocations from end users in the same channel.
Alert on slash command updates where the new URL field points to an external or recently registered domain.

Monitoring Recommendations

Forward Mattermost audit logs and webhook delivery logs to a centralized log analytics platform for retention and querying.
Establish a baseline of expected slash command triggers and webhook destinations, and review changes through periodic configuration audits.
Monitor the rate of slash command create and update API calls per user to surface anomalous behavior.

How to Mitigate CVE-2026-28732

Immediate Actions Required

Upgrade Mattermost Server to a fixed release above 11.5.1, 11.4.3, or 10.11.13 as published by the vendor.
Inventory existing slash commands and remove or disable any with duplicate triggers or unrecognized webhook URLs.
Review the Manage Own Slash Commands permission assignment and restrict it to roles that require integration management.

Patch Information

Mattermost has addressed CVE-2026-28732 in updated releases tracked under advisory MMSA-2026-00597. Refer to the Mattermost Security Updates page for the exact fixed version numbers and upgrade guidance.

Workarounds

Temporarily revoke the Manage Own Slash Commands permission from standard team member roles using System Console role configuration until patching is complete.
Disable non-essential custom slash command integrations through the System Console integrations panel.
Require administrator review of any slash command update requests through change-control processes until the upgrade is applied.

bash

# Configuration example: restrict slash command management at the role level
# Navigate in the System Console:
# System Console > User Management > Permissions > Custom Scheme
# Uncheck: "Manage Slash Commands" for the Team Member role
# Apply changes and audit existing commands via the API:
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  "https://mattermost.example.com/api/v4/teams/$TEAM_ID/commands"