{"id":"GHSA-vph7-r229-qxpf","revision":null,"records":[{"revision":"c92f7edd390f43e69a9ff1aef6ed93bd","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-28736","aliases":[],"title":"Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)","description":"** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.","state":0,"publishedAt":"2026-04-03T13:25:53.399+00:00","modifiedAt":"2026-04-03T14:54:37.869+00:00","affected":[{"ecosystem":"Vendor product","name":"Focalboard","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"Focalboard\",\n                    \"vendor\": \"Mattermost\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"8.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/mattermost-community/focalboard"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-28736","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-28736","identifiers":["CVE-2026-28736"]},"retained":false,"historicalAffected":[]},{"revision":"11984e194f424f1daf2db8a09d0c9f60","observedAt":"2026-10-25T07:19:03.231+00:00","statement":{"source":"nvd","id":"CVE-2026-28736","aliases":[],"title":"** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a st…","description":"** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.","state":0,"publishedAt":"2026-04-03T14:16:29.517+00:00","modifiedAt":"2026-10-23T22:10:00.16+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · responsibledisclosure@mattermost.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/mattermost-community/focalboard"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28736","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-639"],"productCriteria":["cpe:2.3:a:mattermost:focalboard:8.0.0:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-03T14:16:29.517","lastModified":"2026-10-23T22:10:00.160"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-28736","identifiers":["CVE-2026-28736"]},"retained":false,"historicalAffected":[]},{"revision":"4d2c5827959c4903bc12699f08c2653b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-vph7-r229-qxpf","aliases":["CVE-2026-28736","GO-2026-5670"],"title":"Focalboard doesn't validate file ownership when serving uploaded files","description":"** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.","state":0,"publishedAt":"2026-04-03T15:30:31+00:00","modifiedAt":"2026-06-25T23:11:35.9028271+00:00","affected":[{"ecosystem":"Go","name":"github.com/mattermost/focalboard","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"7.10.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-28736","https://github.com/mattermost-community/focalboard"],"sourceUrl":"https://github.com/advisories/GHSA-vph7-r229-qxpf","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vph7-r229-qxpf","identifiers":["GHSA-vph7-r229-qxpf","CVE-2026-28736","GO-2026-5670"]},"retained":false,"historicalAffected":[]},{"revision":"92a266fa715d40f78d0c0c55a7bd8b21","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5670","aliases":["CVE-2026-28736","GHSA-vph7-r229-qxpf"],"title":"Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard","description":"Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard","state":0,"publishedAt":"2026-06-25T22:34:38+00:00","modifiedAt":"2026-06-25T23:01:38.7786141+00:00","affected":[{"ecosystem":"Go","name":"github.com/mattermost/focalboard","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/advisories/GHSA-vph7-r229-qxpf","https://nvd.nist.gov/vuln/detail/CVE-2026-28736"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5670","license":"OSV · upstream source license applies","key":"osv:GO-2026-5670","identifiers":["GO-2026-5670","CVE-2026-28736","GHSA-vph7-r229-qxpf"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T13:35:31.4084177+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T13:35:31.4084177+00:00","lastSuccessAt":"2026-10-26T13:35:31.5775932+00:00","error":null,"lastVerifiedAt":"2026-10-26T13:35:31.5775972+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-e7962156c388e029d9e5dbbcda79fbd40ade61bdd41d51546adb4696b3e29228","complete":true,"records":414161,"lastAttemptAt":"2026-10-26T13:35:30.7074205+00:00","lastSuccessAt":"2026-10-26T11:36:10.2537359+00:00","error":null,"lastVerifiedAt":"2026-10-26T13:35:30.7074205+00:00","snapshotPublishedAt":"2026-10-26T11:28:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T13:35:59.8295777+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4564,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T13:35:31.4084177+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T13:35:31.4084177+00:00","lastSuccessAt":"2026-10-26T13:35:31.5784069+00:00","error":null,"lastVerifiedAt":"2026-10-26T13:35:31.5784074+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-03a3ea3298bf4e3f8edd073e1229d545","complete":true,"records":13416,"lastAttemptAt":"2026-10-26T13:35:57.9513146+00:00","lastSuccessAt":"2026-10-26T13:35:57.948+00:00","error":null,"lastVerifiedAt":"2026-10-26T13:35:57.948+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13477,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T13:35:31.3462861+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T13:35:31.3462861+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T13:35:30.8546246+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T13:35:30.8546246+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7d18ad8657bc2f95d55948e9e16b3c82a8ac06830df5ec8d356048b8420b72c3","complete":true,"records":2972,"lastAttemptAt":"2026-10-26T13:35:31.3609129+00:00","lastSuccessAt":"2026-10-26T11:36:23.0131888+00:00","error":null,"lastVerifiedAt":"2026-10-26T13:35:31.3609129+00:00","snapshotPublishedAt":"2026-10-26T11:33:16+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-690135177074a0c4b9ddcb48232cb870c32b1a7adcd972a81c224810b8437d0d","complete":true,"records":230805,"lastAttemptAt":"2026-10-26T13:35:31.2341103+00:00","lastSuccessAt":"2026-10-26T12:37:54.7648812+00:00","error":null,"lastVerifiedAt":"2026-10-26T13:35:31.2341103+00:00","snapshotPublishedAt":"2026-10-26T11:48:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}