Mattermost versions prior to 11.10.0, 11.7.10, 11.9.2, and 11.8.6 do not limit Slack import account binding to system administrator‑initiated imports. An attacker with team administrator privileges can construct a Slack export that lists the email addresses of existing Mattermost users and force‑add those users to the team. The attacker then creates posts that appear to have been authored by the victims, allowing identity spoofing and potential social engineering or data disclosure. This flaw directly impacts the integrity and authenticity of user‑generated content and enables privileged users to impersonate others without further permission.

The vulnerability affects Mattermost Server installations running any of the following versions: 11.10.x for 11.10.0 and earlier, 11.7.x for 11.7.9 and earlier, 11.9.x for11.9.1 and earlier, and 11.8.x for 11.8.5 and earlier. Only the updated releases 11.11.0, 11.10.1, 11.9.2, 11.8.6, and 11.7.10 (and later) contain the fix.

The CVSS score of 4.3 indicates moderate severity. The exploit requires an authenticated user who has team admin rights, so it is not a blind remote attack. The EPSS score is not available, limiting the ability to estimate real‑world exploitation probability. Because the vulnerability is not listed in CISA KEV, there is no evidence of widespread exploitation yet. Nevertheless, any team admin who processes a malicious Slack import could forge messages, so the risk is considered significant for organizations relying on accurate message attribution.