CVE-2026-2299

—

CVSS 3.1

4.3 medium

EPSS

<1%p2

Published

Jun 25, 2026 (Jun 25, 2026)

Modified

Aug 11, 2026

Description

The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.

Vendors: mattermost
Products: google drive
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.1%)

In the news0 stories

No ingested article mentions this CVE yet.