CVE-2026-2299CWE-862broken-access-control

CVE-2026-2299

Medium · published June 26, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00201 · 9.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-06-26T00:17Z
Affected products (3)
ProductVersionsFixed in
mattermost/google_drive< 1.1.01.1.0
mattermost/google_driveall versions—
mattermost/google_driveall versions—
References (1)
https://github.com/mattermost/mattermost-plugin-google-drive/releases/tag/v1.1.0 · [email protected]
EPSS history
Timeline
  • 25 JUN 18:55Z
    Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint
    cvelistv5