Mattermost contains a vulnerability in how it builds response URLs for custom slash commands. In affected Mattermost versions (11.5.x up to and including 11.5.1, and 10.11.x up to and including 10.11.13), the application fails to validate the HTTP Host header when constructing these response URLs. This allows an authenticated attacker to spoof the Host header so that slash command responses are redirected to an attacker-controlled server.
Technically, the issue is a Host header validation failure (CWE-918) in the custom slash command response URL construction logic. The NVD description indicates the Host header is used without proper validation, enabling an attacker to influence where the system sends/points slash command responses. The attack vector is NETWORK and requires the attacker to be authenticated (PR:L, AC:H), meaning the attacker must have access to an account in Mattermost and then trigger a custom slash command while supplying a spoofed Host header. The exploitation mechanism is effectively a redirect/URL manipulation: by controlling the Host header value, the attacker can cause the constructed response URL to reference an attacker-controlled server, leading to misdirected slash command responses.
Impact is primarily integrity-related with limited confidentiality impact. The CVSS score is 3.5 (low severity) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N. This indicates no direct confidentiality impact (C:N) and no availability impact (A:N), but there is integrity impact (I:L) and a scope change (S:C). In practice, the blast radius is the handling of custom slash command responses: an attacker can redirect those responses to an external system they control. Real-world risk is constrained by the need for authentication and the higher complexity (AC:H), but it can still enable phishing-like redirection or manipulation of where command results are delivered.
Mitigation: apply the vendor’s security update for MMSA-2026-00582. The NVD entry specifies affected versions as Mattermost 11.5.x <= 11.5.1 and 10.11.x <= 10.11.13; therefore, upgrading to a patched release beyond those version thresholds is required. If immediate upgrading is not possible, the safest workaround is to ensure the Host header cannot be spoofed by clients in front of Mattermost (e.g., enforce correct Host header handling at the reverse proxy/load balancer and prevent untrusted Host values from reaching the application). Detection guidance is limited by the provided reference content; however, monitoring for unusual Host header values associated with authenticated users triggering custom slash commands would be a practical approach.
poc_available: false
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CWE-918