Mattermost versions 10.11.x through 10.11.9, 11.1.x through 11.1.2, and 11.2.x through 11.2.1 fail to properly validate login method restrictions. This allows an authenticated user to bypass the SSO‑only login requirement via a userID‑based authentication attempt. The resulting privilege escalation grants the attacker unauthorized access that would normally be prevented by single sign‑on enforcement, constituting an authentication bypass flaw based on CWE‑303.

The vulnerability impacts Mattermost server deployments running any of the following: version 10.11.0 up to 10.11.9, 11.1.0 up to 11.1.2, or 11.2.0 up to 11.2.1. Users of older or newer minor releases are not affected.

The CVSS v3.1 score is 5.4, reflecting medium impact. EPSS indicates a very low exploitation probability (<1%). The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to possess valid user credentials; after authentication, they can choose a userID login instead of the enforced SSO path, bypassing the restriction. The risk is moderate, with limited scope to the authenticated context but significant because it removes the guardrail provided by SSO.