4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28732

CVE-2026-28732: Mattermost doesn't enforce slash command trigger-word uniqueness during command updates

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash commands via editing their own slash command trigger to an already-registered trigger through the command update API. Mattermost Advisory ID: MMSA-2026-00597

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28732

CVE-2026-28732:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost/server/v8	go	>= 10.11.0, < 10.11.14	10.11.14
github.com/mattermost/mattermost/server/v8	go	>= 11.4.0, < 11.4.4	11.4.4
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20260306123948-f5fe8ded6b63	8.0.0-20260306123948-f5fe8ded6b63
github.com/mattermost/mattermost-server	go	< 5.3.2-0.20260306123948-f5fe8ded6b63	5.3.2-0.20260306123948-f5fe8ded6b63

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-28732, allows an authenticated user with 'Manage Own Slash Commands' permission to hijack existing slash commands. This is because the application failed to enforce the uniqueness of slash command trigger words during an update or move operation. The analysis of the patch commit f5fe8ded6b633db7804ae25b42ea12ce635d6ea6 reveals that the functions responsible for updating and moving commands, App.UpdateCommand and App.MoveCommand, were missing this critical validation. An attacker could craft an API request to change their command's trigger to one that was already registered, either by the system or another user. The patch rectifies this by introducing a new function, validateCommandTriggerUniqueness, which checks for trigger conflicts against both built-in commands and existing custom commands within a team. This new validation function is then called from App.UpdateCommand, App.MoveCommand, and the corresponding PluginAPI.UpdateCommand function, ensuring that any attempt to create a duplicate trigger word is blocked.

Vulnerable functions

App.UpdateCommand

server/channels/app/command.go

The `UpdateCommand` function in `server/channels/app/command.go` did not validate if the new trigger word for a slash command was already in use by another command in the same team. This allowed an attacker to update their own command to use the trigger of an existing command, effectively hijacking it. The patch adds a call to `validateCommandTriggerUniqueness` to prevent this.

App.MoveCommand

server/channels/app/command.go

The `MoveCommand` function in `server/channels/app/command.go` did not check if the command's trigger word already existed in the destination team. This could lead to a command with a duplicate trigger word being moved into a team, causing a conflict and potential hijacking. The patch introduces a call to `validateCommandTriggerUniqueness` to ensure the trigger is unique in the target team before moving.

PluginAPI.UpdateCommand

server/channels/app/plugin_api.go

The `UpdateCommand` function exposed via the Plugin API in `server/channels/app/plugin_api.go` also lacked the trigger uniqueness validation. This provided another entry point for the vulnerability, allowing plugins to potentially perform the same command hijacking. The patch adds the same `validateCommandTriggerUniqueness` check here.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.