The Mattermost Google Drive plugin before version 1.1.0 contains a missing authorization check (CWE-862) in its file creation endpoint. This allows authenticated users with a connected Google account to bypass channel membership validation and share files to unauthorized private channels, potentially exposing private channel membership details. The vulnerability affects all plugin versions up to and including 1.0.0. No official patch or remediation guidance has been published by the vendor as of the data provided.

An attacker who is authenticated and has a connected Google account can share Google Drive files to private channels they do not belong to, thereby disclosing private channel membership and potentially sensitive information shared within those channels. The confidentiality of private channels is compromised, but there is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only and monitor for unauthorized sharing activities. Avoid connecting Google accounts to the plugin in environments with sensitive private channels if possible.