CVE-2026-28736

MEDIUM

Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)

Title source: cna

Description

** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.

References (1)

[Product] https://github.com/mattermost-community/focalboard

Scores

CVSS v3 4.3

EPSS 0.0001

EPSS Percentile 1.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-639

Status published

Products (3)

mattermost/focalboard 8.0.0

Mattermost/Focalboard < 8.0

mattermost/focalboard 0Go

Published Apr 03, 2026

Tracked Since Apr 03, 2026