← voltar
CVE-2026-28736

Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)

CVSS 4.3 MEDIUMEPSS 0.2%CWE-639
** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Mattermost · Focalboard

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →