CVE-2026-2299

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-2299

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2299.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-2299

Published

2026-06-25T18:55:11.905Z

Modified

2026-08-04T11:48:42.443377648Z

Severity

4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint

Details

The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2299.json",
    "cna_assigner": "Mattermost",
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Git / github.com/mattermost/mattermost-plugin-google-drive

Affected ranges

Type

GIT

Repo

https://github.com/mattermost/mattermost-plugin-google-drive

Events

Introduced

Last affected

7984e2cfa9eb72ccd43ab8830e8689aa39b486ff

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.1.0-alpha

v1.*

v1.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2299.json"