CVE-2026-28736: Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)
Published Apr 3, 2026
·Updated
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.
Affected Software
2 affected components
go/github.com/mattermost/focalboard<=7.10.6
Mattermost Focalboard=8.0.0
Event History
Apr 3, 2026
CVE Published
via MITRE·01:25 PM
Data Sourced
via MITRE·01:25 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
Affected Software
Advisory Published
via GitHub·03:30 PM
Data Sourced
via GitHub·03:30 PM
DescriptionSeverityWeaknessAffected Software