CVE-2026-19076: Mattermost 11.10.0 through 11.10.0, 11.7.0 through 11.7.9, 11.9.0 through 11.9.1, 11.8.0 through 11.8.5

Affected technology

Mattermost · 11.10.0 through 11.10.0, 11.7.0 through 11.7.9, 11.9.0 through 11.9.1, 11.8.0 through 11.8.5
Mattermost

Description’s affected range: versions 11.10.x <= 11.10.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

An attacker with a valid OAuth bearer token for a target user can permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider via a crafted request to POST /api/v4/users/login/switch. Vendor/CNA’s CVSS 3.1 assessment (base score 4.4/10) rates confidentiality and availability impact as none; integrity impact as high.