High · 7.5 CVE-2023-6912 EUVD-2023-59111GHSA-6qxg-cm55-g85x

Brute force vulnerability in M-Files user authentication

Published Dec 20, 2023 · Updated Feb 23, 2026 · Assigned by M-Files Corporation

Description

Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords.

Affected products

Vendor	Product	Affected	Fixed
M-Files	M-Files Server	< 23.12.13205.0	23.12.13205.0

References

https://product.m-files.com/security-advisories/cve-2023-6912/ vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2023-6912 vendor-advisory