Mattermost Server 10.11.x < 10.11.14 / 11.4.x < 11.4.4 / 11.5.x < 11.5.2 Vulnerability (MMSA-2026-00597)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(321516);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/24");

  script_cve_id("CVE-2026-28732");
  script_xref(name:"IAVA", value:"2026-A-0604");

  script_name(english:"Mattermost Server 10.11.x < 10.11.14 / 11.4.x < 11.4.4 / 11.5.x < 11.5.2 Vulnerability (MMSA-2026-00597)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Mattermost Server installed on the remote host is affected by a vulnerability:

  - Mattermost fails to enforce slash command trigger-word uniqueness during command updates which allows an
    authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing
    system or custom slash commands via editing their own slash command trigger to an already-registered
    trigger through the command update API. (CVE-2026-28732)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mattermost.com/security-updates/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Mattermost Server version 10.11.14, 11.4.4, 11.5.2, 11.6.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-28732");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mattermost:mattermost_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("mattermost_server_detect.nbin");
  script_require_keys("installed_sw/Mattermost Server");

  exit(0);
}

include('vcf.inc');
include('http.inc');

var port = get_http_port(default:80);

var app_info = vcf::get_app_info(app:'Mattermost Server', port:port, webapp:true);

var constraints = [
  { 'min_version' : '10.11.0', 'fixed_version' : '10.11.14' },
  { 'min_version' : '11.4.0', 'fixed_version' : '11.4.4' },
  { 'min_version' : '11.5.0', 'fixed_version' : '11.5.2', 'fixed_display' : '11.5.2 / 11.6.0' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_WARNING
);