What is the CVSS score of CVE-2026-2299?

CVE-2026-2299 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Mattermost Google Drive Plugin CVE-2026-2299

EUVD-2026-39540 MEDIUM

Missing Authorization (CWE-862)

2026-06-25 Mattermost

GHSA-m2c6-qhf9-2xm8

Authentication Bypass Mattermost Google Mattermost Google Drive Plugin

4.3

CVSS 3.1 · NVD

Severity by source

Vendor (Mattermost) PRIMARY

MEDIUM

qualitative

NVD

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.2 MEDIUM

Network-reachable endpoint but AC:H because attacker must know a private channel ID; PR:L for mandatory Mattermost auth plus linked Google account; C:L/I:L for membership disclosure and unauthorized file posting; A:N as no service disruption occurs.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 11, 2026 - 14:22 NVD

4.2 (MEDIUM) 4.3 (MEDIUM)

Source Code Evidence Fetched

Jun 25, 2026 - 20:24 vuln.today

Analysis Generated

Jun 25, 2026 - 20:24 vuln.today

DescriptionNVD

The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.

AnalysisAI

Missing authorization in the Mattermost Google Drive plugin's file creation endpoint (all versions before 1.1.0) allows authenticated Mattermost users with a linked Google account to share Drive files into private channels they are not a member of, and to infer the existence and membership of those private channels. The root cause is CWE-862 (Missing Authorization): the endpoint processes the target channel ID supplied by the caller without verifying the caller belongs to that channel. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

The affected component is a Mattermost server-side plugin (CPE: cpe:2.3:a:mattermost:mattermost_google_drive_plugin:*:*:*:*:*:*:*:*) that wraps Google Drive APIs, allowing users who have OAuth-connected their Google account to share Drive files directly into Mattermost channels. The file creation endpoint accepts a caller-supplied channel identifier and performs the share operation without first asserting channel membership for the requesting user. This is a textbook CWE-862 (Missing Authorization) defect - the access control check is absent rather than incorrectly implemented. The fix, introduced in commit 5965467 ('Improve authorization for file creation endpoint'), adds the missing membership check. The plugin requires Mattermost Server 6.2.1 or later.

RemediationAI

Upgrade the Mattermost Google Drive plugin to version 1.1.0, which contains the authorization fix introduced in commit 5965467 ('Improve authorization for file creation endpoint'). The release is available at https://github.com/mattermost/mattermost-plugin-google-drive/releases/tag/v1.1.0 and requires Mattermost Server 6.2.1+. If immediate patching is not feasible, disable the Google Drive plugin entirely in the Mattermost system console until the upgrade can be applied - this eliminates the vulnerable endpoint at the cost of losing all Google Drive integration functionality for users. Restricting plugin access to a trusted subset of users is a partial mitigation but does not eliminate the risk, since the vulnerability is exploitable by any authenticated user with a connected Google account.