The vulnerability arises when Mattermost forms response URLs for custom slash commands without validating the Host header, enabling an authenticated attacker to spoof that header and cause the slash command response to be redirected to an attacker‑controlled server. This allows the attacker to retrieve the command response payload, potentially exposing sensitive data transmitted by the slash command. The flaw represents a type of SSRF that can surface confidential information to an external system.

The issue affects Mattermost instances running version 11.5.1 or earlier, as well as versions 10.11.13 and earlier. Any environment where the vulnerable versions are deployed and custom slash commands are enabled is susceptible. The official advisory recommends updating to 11.6.0, 11.5.2, or 10.11.14 and later releases.

The CVSS base score of 3.5 indicates low severity, and there is no EPSS score, signaling a low documented exploitation probability. The vulnerability requires that the attacker already possess authenticated access to the Mattermost instance or a foothold within the network. While the leak can expose internal data, it does not allow arbitrary code execution or privilege escalation on the server itself. Organizations should treat this as a low‑to‑moderate risk that could be mitigated by applying the release fix.