An issue exists in Mattermost Server prior to 3.5.1. E-mail address verification can be bypassed.
mattermost mattermost server