The vulnerability lies in the lack of CSRF token validation on an authentication endpoint, a security weakness categorized as CWE‑352. An attacker can force an authenticated user to execute a forged request that changes the user’s authentication method, potentially granting the attacker control over that account. This modification subverts the intended authentication flow and can lead to unauthorized access to a user’s data.

The flaw affects Mattermost deployments running versions 10.11.x through 10.11.12, 11.5.x through 11.5.0, 11.4.x through 11.4.2, and 11.3.x through 11.3.2. All affected instances are susceptible if they have the vulnerable authentication endpoint exposed.

The CVSS base score of 6.8 classifies the issue as moderately severe, and the lack of an EPSS score indicates no current evidence of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting it has not yet been actively leveraged. However, its exploit requires a victim to visit a malicious page, making a CSRF attack the likely vector. The vulnerability can be exploited without privileged access and only needs the victim to be authenticated to the target Mattermost instance.