Medium · 4.8 CVE-2022-4861 EUVD-2022-52127GHSA-qx2w-wx28-8mhv

Incorrect Implementation of Authentication Algorithm

Published Dec 30, 2022 · Updated Feb 23, 2026 · Assigned by M-Files Corporation

Description

Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource.

Affected products

Vendor	Product	Affected	Fixed
M-Files	M-Files Client	< 22.5.11356.0	22.5.11356.0

References

https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4861/
https://product.m-files.com/security-advisories/cve-2022-4861/ vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2022-4861 vendor-advisory