Mattermost fails to enforce uniqueness of slash command trigger words when a user updates a command. The flaw allows an authenticated team member with Manage Own Slash Commands permission to modify their own trigger to match an existing system or custom command and thereby hijack it. The attacker can then execute the impersonated command as if it were issued by another user or the system, potentially gaining privilege or performing unauthorized actions. This issue is classified as CWE-863.

The vulnerability affects Mattermost versions 10.11.x up to 10.11.13, 11.4.x up to 11.4.3, and 11.5.x up to 11.5.1. Users of these releases should verify they are running a fixed build.

The CVSS score is 4.3, indicating a moderate risk level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attacks are limited to authenticated users who have been granted Manage Own Slash Commands permission within a team; they must send the update request through the command update API. Because the flaw involves command hijacking rather than remote code execution, the impact is confined to misuse of the system’s slash commands.