Unrated severityNVD Advisory· Published Jun 25, 2026· Updated Jun 26, 2026

Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint

CVE-2026-2299

Description

The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.

Patches

Vulnerability mechanics

References

github.com/mattermost/mattermost-plugin-google-drive/releases/tag/v1.1.0mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000