CVE-2026-28736
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Focalboard version 8.0 (unsupported product) fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the file content. The product is no longer maintained and no fix will be issued.
Risk Assessment
An authenticated attacker can access other users' confidential files, potentially leading to data leakage.
Recommendation
Migrate to another actively maintained solution, as Focalboard will not receive fixes.
Original NVD description (English source)
** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.