EUVD-2026-18653
GHSA-vph7-r229-qxpf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
Lifecycle Timeline
3DescriptionCVE.org
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.
AnalysisAI
Focalboard 8.0 fails to validate file ownership during file serving, allowing authenticated attackers to read arbitrary uploaded files if they know the target fileID. The vulnerability affects all versions of the standalone Focalboard product, which is no longer maintained by Mattermost and will not receive security patches. An attacker with valid credentials can exploit this authorization bypass with no additional user interaction to access sensitive file contents.
Technical ContextAI
Focalboard is a self-hosted project management and collaboration platform maintained by Mattermost. The vulnerability exists in the file serving mechanism, which is governed by CWE-639 (Authorization Bypass Through User-Controlled Key), a weakness in access control logic. The affected product uses CPE designation cpe:2.3:a:mattermost:focalboard:*:*:*:*:*:*:*:*, indicating all versions are potentially vulnerable. The root cause is inadequate authorization checks when retrieving uploaded files-the application accepts a fileID parameter from authenticated users without verifying that the requesting user owns or has permission to access the specific file. This allows attackers to enumerate or discover fileIDs (through error messages, directory traversal, or prior knowledge) and retrieve files belonging to other users.
RemediationAI
No vendor-released patch exists for Focalboard standalone; Mattermost has stated that the product is unsupported and no fix will be issued. Organizations currently running standalone Focalboard should migrate to an actively maintained alternative or deploy Focalboard as an integrated plugin within Mattermost Server (if security patches are available in that distribution). As an interim mitigation, restrict file serving endpoints to authenticated users only and implement strict access controls at the network level to limit exposure; additionally, audit access logs and fileID usage patterns to detect unauthorized file enumeration attempts. No workaround exists within Focalboard itself to re-enable file ownership validation without code modification.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today