High · 7.5 CVE-2023-2480 EUVD-2023-33964GHSA-xgf2-5w76-r5jg

Elevation of Privilege in M-Files Desktop Client

Published May 25, 2023 · Updated Feb 23, 2026 · Assigned by M-Files Corporation

Description

Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications

Affected products

Vendor	Product	Affected	Fixed
M-Files	M-Files Client	< 23.5.12598.0	23.5.12598.0

References

https://product.m-files.com/security-advisories/cve-2023-2480/ vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2023-2480 vendor-advisory