CVE-2026-2299

Analyzed Analyzed - Analysis Complete

Mattermost Google Drive Plugin Channel Membership Validation Flaw

Publication date: 2026-06-25

Last updated on: 2026-08-11

Assigner: Mattermost, Inc.

Description

The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-08-11

Generated

2026-08-25

AI Q&A

2026-06-25

EPSS Evaluated

2026-08-24

NVD

CVE-2026-2299

EUVD

EUVD-2026-39540

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	google_drive	to 1.1.0 (exc)
mattermost	google_drive	1.1.0
mattermost	google_drive	1.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The vulnerability exists in the Mattermost Google Drive plugin before version 1.1.0. It occurs because the plugin fails to properly validate whether a user is a member of a channel when creating files. This flaw allows authenticated users who have connected their Google account to share Google Drive files to private channels they are not authorized to access. Additionally, it can disclose the membership of these private channels.

Impact Analysis

This vulnerability can lead to unauthorized disclosure of private channel membership and sharing of Google Drive files to private channels without proper authorization. As a result, sensitive information intended to be restricted within private channels could be exposed to unauthorized users, potentially compromising confidentiality and privacy.

Compliance Impact

The vulnerability allows authenticated users to share Google Drive files to unauthorized private channels and disclose private channel membership. This unauthorized disclosure of private information could potentially lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require strict controls on access to personal and sensitive information.

Hi! I’m here to help you understand CVE-2026-2299. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70