CVE-2024-2450 is a high severity (CVSS 8.8) flaw in Mattermost Server. It fails to verify account ownership when a user switches from email to SAML sign in, so an authenticated attacker can take over other accounts. Fixed in 8.1.10, 9.2.6, 9.3.2 and 9.4.3.
What's affected
From the NVD record:
- Mattermost 8.1.x before 8.1.10
- 9.2.x before 9.2.6
- 9.3.x before 9.3.2
- 9.4.x before 9.4.3
The fixed versions are therefore 8.1.10, 9.2.6, 9.3.2 and 9.4.3. The record adds that exploitation happens through a crafted switch request under specific conditions. I could not load the entry on Mattermost's security updates page, which fills in dynamically, so check it for any detail added after the CVE was published. I found no second severity figure, so there is no conflict to report.
How to check if you're exposed
Check your server version in the System Console, or from the command line on the server:
mattermost version
Compare it with the list above. Then check whether SAML is configured, since the flaw sits in the switch from email to SAML authentication. Servers that do not use SAML may have a smaller exposure, but the record does not say they are unaffected, so patch regardless.
What to do now
- Upgrade to 8.1.10, 9.2.6, 9.3.2, 9.4.3 or a later release.
- Read the vendor's security updates page for the entry on this issue.
- Review recent authentication method changes in the audit log and look for accounts that moved to SAML unexpectedly.
- If you find suspicious switches, reset the affected sessions and notify the account owners.
- Keep up with Mattermost patch releases. The vendor states a mandatory upgrade policy for security fixes.
Why it matters
The record lists CWE-287, improper authentication, and CWE-306, missing authentication for a critical function. When a user changes how they sign in, the server must be sure the account being converted belongs to that user. Skipping that check lets one person claim another's identity.
Chat servers hold private conversations, files and integration tokens. An account takeover gives an attacker whatever the victim could see, including channels that hold credentials people pasted in.
The CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not say it was exploited.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan helps you track the open source components in your own software.
Quick check
Does the attacker need an account?
Yes. The record says an authenticated attacker can take over other user accounts under specific conditions.
Which version should I run?
Run the fixed release for your branch, 8.1.10, 9.2.6, 9.3.2 or 9.4.3, or something newer.
Sources
- Mattermost security updates
- NVD record for CVE-2024-2450
Last reviewed: 19 October 2026.
