Vulnerability · Published Jun 25, 2026 · Assigned by Mattermost
CVE-2026-2299Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint
Medium 4.2
In plain English
A medium-severity missing authorization in Mattermost Google Drive Plugin from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.2%top 90.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost Google Drive Plugin | 0 – through 1.0.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N