CoreCVE
Back

MEDIUM

Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint

Published Jun 25, 2026

Description

The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.

Affected products

Remediation

Vendor solution

Update Mattermost Google Drive plugin to version 1.1.0 or higher.

Weaknesses (1)

CWE-862

Missing Authorization

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Mattermost
Published Jun 25, 2026
Updated Jun 26, 2026
Reserved Feb 10, 2026
Link CVE-2026-2299
CISA Vulnrichment
Updated Jun 26, 2026
NVD
Status Analyzed
Modified Aug 11, 2026
Link CVE-2026-2299
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-2299
ENISA EUVD
Assigner n/a
Published n/a
Updated n/a
Exploited since n/a
Link n/a