CVE-2026-28736 — Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)

CVE-2026-28736

Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix) PUBLISHED

Description (CNA)

** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.

Affected (CNA)

Vendor / product	Versions
Mattermost / Focalboard	affected 0 through 8.0

CWE

CWE-639

References

https://github.com/mattermost-community/focalboard

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.