CVE-2026-2299: Mattermost Google Drive

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.

Affected products

• Mattermost Google Drive: before 1.1.0 (fixed in 1.1.0); version 1.1.0 only

Published 2026-06-25. Last modified 2026-08-11.