← Back

CVE-2026-2299

nvd nist
Published: Jun 25, 2026Modified: Aug 11, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.

Affected (3)

Mattermost
1 product
Google Drive
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost
Google Drive
Before 1.1.0
Google Drive
Version 1.1.0 rc1
Google Drive
Version 1.1.0 rc2

Related CWEs

CWE-862
Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

Source: responsibledisclosure@mattermost.com
ProductRelease Notes

Timeline

No history available yet.