An authenticated user on a vulnerable Mattermost server can issue a request to the authentication switch endpoint that bypasses the expected confirmation step when changing the account's authentication provider. The flaw allows the attacker to change the account password without prior verification, effectively enabling account takeover. The weakness is classified as CWE‑863 (Improper Authentication).

Mattermost servers running the 10.11.x release series up to 10.11.10 inclusive are affected. Updated releases of 10.11.11 and any later 10.x or 11.x releases, including 11.4.0 and above, contain the fix. No other products or earlier branches are known to be impacted.

The CVSS score is 3.1, indicating low severity, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers must already be authenticated to the target Mattermost instance to exploit the flaw, but once authenticated they can change the password of that account and potentially take over it.