{"id":"EUVD-2026-30760","enisaUuid":"ea0436a4-e8e2-37bf-b272-8752a321cef8","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13, 11.4.x \u003c\u003d 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash commands via editing their own slash command trigger to an already-registered trigger through the command update API. Mattermost Advisory ID: MMSA-2026-00597","datePublished":"May 18, 2026, 8:35:40 AM","dateUpdated":"May 18, 2026, 2:37:33 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2026-28732\nGHSA-wvcv-9xpm-7mqc\n","assigner":"Mattermost","epss":0.15,"enisaIdProduct":[{"id":"cf4092d4-930a-3972-ab6a-4bf41bfb342b","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"},{"id":"d8e172f6-112d-3ae8-b21b-13f43bb4dba3","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.4.0 ≤11.4.3"},{"id":"ec83f558-c3e5-3ffb-971b-9b9d65098d89","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"}],"enisaIdVendor":[{"id":"c6ec1558-005f-39e9-a092-45ce855cc31b","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"26fdc231-8086-3d87-93c3-c3168571349b","vulnerability":{"id":"CVE-2026-28732","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13, 11.4.x \u003c\u003d 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash commands via editing their own slash command trigger to an already-registered trigger through the command update API. Mattermost Advisory ID: MMSA-2026-00597","datePublished":"May 18, 2026, 8:35:40 AM","dateUpdated":"May 18, 2026, 2:37:33 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30760\n","assigner":"Mattermost","epss":0.15,"dataProcessed":"Nov 1, 2026, 4:08:32 AM","vulnerabilityProduct":[{"id":"09a8066f-d113-3e8d-8002-287cbcb37254","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.4.0 ≤11.4.3"},{"id":"aa8d2751-f784-37b8-bdd6-3494102fdd27","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"},{"id":"d7ee80db-682b-3c3c-a28c-da5519785f21","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"}],"vulnerabilityVendor":[{"id":"6c8c5eb5-a73b-347e-bc63-e3b5917f9016","vendor":{"name":"Mattermost"}}]}},{"id":"ef39cf55-474d-3a50-81de-5cca4c7d69ff","vulnerability":{"id":"GHSA-wvcv-9xpm-7mqc","description":"Mattermost doesn\u0027t enforce slash command trigger-word uniqueness during command updates","datePublished":"May 18, 2026, 9:31:48 AM","dateUpdated":"Jun 1, 2026, 3:13:28 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-28732\nhttps://github.com/mattermost/mattermost/commit/f5fe8ded6b633db7804ae25b42ea12ce635d6ea6\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30760\n","aliases":"CVE-2026-28732\nGHSA-wvcv-9xpm-7mqc\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}