The vulnerability originates from improper CSRF token validation in the /api/v4/access_control_policies/{policy_id}/activate endpoint. An attacker can craft a request that convinces an authenticated administrator to alter the active status of an access control policy. This allows the attacker to enable or disable policies without authorization, potentially changing the intended permissions for users and compromising the integrity of access controls.

The issue affects Mattermost Server. Versions 11.2.0 through 11.2.2, 10.11.0 through 10.11.10, 11.4.0, and 11.3.0 through 11.3.1 are vulnerable. Updating to the recommended patched releases of 11.5.0, 11.2.3, 10.11.11, 11.4.1, 11.3.2, or later resolves the flaw.

The CVSS score of 4.6 indicates moderate severity. An EPSS score below 1% and absence from the KEV catalog suggest that exploitation of this flaw is currently unlikely, although the attacker only needs a browser session with an authenticated administrator to carry out the CSRF attack. Consequently, the risk remains moderate, but administrators should consider promptly applying the patch.