An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.