GitHub Advisoryadvisory · Go

GHSA-vph7-r229-qxpf Focalboard doesn't validate file ownership when serving uploaded files

MEDIUM Published 2026-04-03 Modified 2026-04-06 Official page ↗
Aliases
CVE-2026-28736
Ecosystem
Go
Packages
github.com/mattermost/focalboard
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-639
Reviewed
2026-04-06

Affected packages

• Go github.com/mattermost/focalboard: <= 7.10.6 (no fix yet)

Description

UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.

Related

Alias · CVE (1)

  • CVE-2026-28736 ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References