CVE-2026-2299

The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.

Score

CVSS 3.1 4.3 Medium

Status

Analyzed - responsibledisclosure@mattermost.com

Published

2026-06-25

Last modified

2026-10-25

Weaknesses

CWE-862

Affected products

• Google Drive (Mattermost)
• Mattermost Google Drive Plugin (Mattermost)

References

• https://github.com/mattermost/mattermost-plugin-google-drive/releases/tag/v1.1.0