CVE-2026-19076: Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider via a crafted request to POST /api/v4/users/login/switch.. Mattermost Advisory ID: MMSA-2026-00758
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.1 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.10 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.6
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs a valid OAuth bearer token for the target user. Exploitation also requires sending a crafted request to the account type switch endpoint, POST /api/v4/users/login/switch.
Which deployments are affected?
Affected versions are Mattermost 11.10.x through 11.10.0, 11.7.x through 11.7.9, 11.9.x through 11.9.1, and 11.8.x through 11.8.5. The issue concerns SSO-backed user accounts.
What is the impact if exploitation succeeds?
An attacker can set an attacker-controlled password and detach the target account from its identity provider. This can permanently take over the target user's SSO-backed account.