Low · 2.0 CVE-2021-41808 EUVD-2021-28813GHSA-h62q-wxxr-4qqj

In M-Files Server product with versions before 21.11.10775.0, enabling logging of federated authentication would write sensitive information to event logs.

Published Jan 18, 2022 · Updated Feb 23, 2026 · Assigned by M-Files Corporation

Description

In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default.

Affected products

Vendor	Product	Affected	Fixed
M-Files	M-Files Server	Online – < 21.11.10775.0, 2018 – < 21.11.10775.0	21.11.10775.0

References

https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/
https://empower.m-files.com/security-advisories/CVE-2021-41808 vendor-advisory