CVE-2026-2299— Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint
Quick assessment
Affected
Mattermost Mattermost Google Drive Plugin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mattermost Google Drive Plugin是美国Mattermost公司的一个Mattermost平台的Google Drive集成插件。 Mattermost Google Drive Plugin 1.1.0之前版本存在授权问题漏洞，该漏洞源于在文件创建端点未验证频道成员身份，可能导致经过身份验证的用户将文件分享到未授权的私人频道并泄露私人频道成员信息。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mattermost | Mattermost Google Drive Plugin | ≤ 1.0.0 |
affected |
1.1.0 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-2299
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Mattermost Google Drive Plugin 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mattermost Google Drive Plugin是美国Mattermost公司的一个Mattermost平台的Google Drive集成插件。 Mattermost Google Drive Plugin 1.1.0之前版本存在授权问题漏洞，该漏洞源于在文件创建端点未验证频道成员身份，可能导致经过身份验证的用户将文件分享到未授权的私人频道并泄露私人频道成员信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mattermost | Mattermost Google Drive Plugin | 0 ~ 1.0.0 | - |
|
II. Public POCs for CVE-2026-2299
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-2299
请登录查看更多情报信息。
Vendor Pages for CVE-2026-2299 (1)
IV. Related Vulnerabilities
Same vendor: Mattermost
-
CVE-2026-18799
Mattermost Server fails to restrict Slack import account bin -
CVE-2026-16251
Mattermost local image proxy allows server memory exhaustion -
CVE-2026-18256
Private team metadata disclosure via the team search API -
CVE-2026-18223
Mattermost invitation tokens not bound to invited email addr -
CVE-2026-19076
Mattermost fails to reject OAuth application sessions in acc
Same weakness: CWE-862
-
CVE-2026-9589
Unblu Spark Authorization Bypass in Configuration Cascade Op -
CVE-2026-112787
OpenCATS before 0.10.0 Missing Authorization in Reports Modu -
CVE-2026-112786
OpenCATS before 0.10.0 Missing Authorization via Import Reve -
CVE-2026-112785
OpenCATS before 0.10.0 Missing Authorization in Saved-List A -
CVE-2026-112783
OpenCATS before 0.10.0 Missing Authorization via Activity AJ
V. Comments for CVE-2026-2299
No comments yet