Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0 Account Type Switch Endpoint switch improper authentication

Summaryinfo

A vulnerability described as problematic has been identified in Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0. Affected by this issue is some unknown functionality of the file /api/v4/users/login/switch of the component Account Type Switch Endpoint. Such manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-19076. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Mattermost up to 11.7.9/11.8.5/11.9.1/11.10.0. Affected by this issue is an unknown code block of the file /api/v4/users/login/switch of the component Account Type Switch Endpoint. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is integrity. CVE summarizes:

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider via a crafted request to POST /api/v4/users/login/switch.. Mattermost Advisory ID: MMSA-2026-00758

The advisory is available at mattermost.com. This vulnerability is handled as CVE-2026-19076 since 08/06/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit.

Upgrading to version 11.7.10, 11.8.6, 11.9.2, 11.10.1 or 11.11.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-102747) and CERT Bund (WID-SEC-2026-4009). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Mattermost Mattermost

Productinfo

Type

• Groupware Software

Name

• Mattermost

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.7.0
• 11.7.1
• 11.7.2
• 11.7.3
• 11.7.4
• 11.7.5
• 11.7.6
• 11.7.7
• 11.7.8
• 11.7.9
• 11.8
• 11.8.0
• 11.8.1
• 11.8.2
• 11.8.3
• 11.8.4
• 11.8.5
• 11.9
• 11.9.0
• 11.9.1
• 11.10.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion