The Mattermost Google Drive plugin, in versions prior to 1.1.0, does not verify that a user belongs to a channel before allowing them to create a file share to that Because users with a Google account that is already authenticated can use the file creation endpoint, they can attach a file to a private channel they are not a member of, thereby revealing the membership and contents of the channel. The flaw is a classic missing permissions error, identified as CWE-862, and results in unauthorized data exposure and potential compromise of the privacy of private channels.

Affected product is the Mattermost Google Drive Plugin. All released versions earlier than 1.1.0 are vulnerable. The vulnerability applies to installations of the plugin regardless of the Mattermost server version, as the flaw resides in the plugin itself.

The CVSS score of 4.2 indicates a moderate severity. EPSS is not reported, so the exploitation likelihood is unclear but the vulnerability requires authenticated access to the plugin's file creation API, meaning a known user or social engineering could trigger it. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmed exploitation. Nevertheless, the potential for privacy leakage makes it a concern for organisations handling sensitive channel data.