CVE-2026-22545: Mattermost fails to validate user's authentication method when processing account auth type switch

March 16, 2026 (updated March 19, 2026)

Mattermost versions 10.11.x <= 10.11.10 fail to validate user’s authentication method when processing account auth type switch which allows an authenticated attacker to change account password without confirmation via falsely claiming a different auth provider.. Mattermost Advisory ID: MMSA-2026-00583

References

github.com/advisories/GHSA-rv67-7w2g-7976
github.com/mattermost/mattermost
github.com/mattermost/mattermost/commit/ced9a56e3988fe9fd4559d45f9971dbd562e2218
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-22545

Code Behaviors & Features

Detect and mitigate CVE-2026-22545 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →