Skip to content
OpenAdvisories

Package · Go

github.com/mattermost/focalboard

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 4.3
    CVE-2026-28736

    Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)

    ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is…

    Mattermost Focalboard github.com/mattermost/focalboard Go
  • High 8.1
    CVE-2026-25773

    Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix)

    ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored …

    Mattermost Focalboard github.com/mattermost/focalboard Go