High · 7.5 CVE-2021-41807 EUVD-2021-28812GHSA-5c8j-7c6c-838x

Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.

Published Jan 18, 2022 · Updated Feb 23, 2026 · Assigned by M-Files Corporation

Vendor: M-Files Product: M-Files Server Product: M-Files Web

Description

Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier.

Affected products

Vendor	Product	Affected	Fixed
M-Files	M-Files Server	Online – < 21.12.10873.0, 2018 – < 21.12.10873.0	21.12.10873.0
M-Files	M-Files Web	Classic – < 21.12.10873.0, vNext – < 21.12.10873.0	21.12.10873.0

References

https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41807/
https://empower.m-files.com/security-advisories/CVE-2021-41807 vendor-advisory