CVE-2026-25773
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Focalboard 8.0 fails to sanitize category IDs before using them in dynamic SQL statements when reordering categories. An authenticated attacker can inject malicious SQL into the category ID field, leading to exfiltration of password hashes of other users. The product is unsupported and no fix will be issued.
Risk Assessment
An authenticated attacker can exfiltrate sensitive data, including password hashes, potentially leading to privilege escalation and account takeover.
Recommendation
Discontinue use of Focalboard as a standalone product. Migrate to an alternative solution that is actively maintained.
Other vulnerabilities in Focalboard
Original NVD description (English source)
** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitized when the category reorder API processes the stored value. This Second-Order SQL Injection (Time-Based Blind) allows an authenticated attacker to exfiltrate sensitive data including password hashes of other users. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.