PT-2026-25757 · Mattermost · Github.Com/Mattermost/Mattermost-Server+1

Daw10 · Published 2026-02-13 · Updated 2026-03-27 · CVE-2026-22545

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.10

Description Mattermost does not properly validate a user's authentication method when processing an account authentication type switch. This allows an authenticated attacker to change an account password without confirmation by falsely claiming a different authentication provider. The issue is present in the github.com/mattermost/mattermost-server module before version v5.3.2-0.20260127144908-ced9a56e3988.

Recommendations Update Mattermost to a version later than 10.11.10. Update the github.com/mattermost/mattermost-server module to version v5.3.2-0.20260127144908-ced9a56e3988 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2026-06558

CVE-2026-22545

GHSA-RV67-7W2G-7976

GO-2026-4786

SUSE-SU-2026:1135-1

Affected Products

Mattermost

Github.Com/Mattermost/Mattermost-Server

References · 152

• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06558 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22545 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rv67-7w2g-7976 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22545 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4786 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/ced9a56e3988fe9fd4559d45f9971dbd562e2218 · Note
• https://suse.com/security/cve/CVE-2026-22545 · Note
• https://suse.com/security/cve/CVE-2026-33281 · Note
• https://suse.com/security/cve/CVE-2026-33132 · Note
• https://suse.com/security/cve/CVE-2026-33191 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22545 · Note
• https://suse.com/security/cve/CVE-2026-33066 · Note