# CVE-2026-25773: Mattermost Focalboard SQL injection in category reorder API

Source: https://junglewise.ai/threats/cve-2026-25773-mattermost-focalboard-sql-injection-in-category-reorder-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-25773 · Severity: high · CVSS 8.1 · Published 2026-04-03

Focalboard is an open-source project management tool used as an alternative to Trello and Notion. A security flaw allows an authenticated user to perform a database attack that can lead to the theft of sensitive information, including the password hashes of other users. Because this standalone version of the product is no longer maintained, no official security patch will be released to fix this issue.

Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-25773 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25773 being exploited in the wild.

**How severe is CVE-2026-25773?** High severity, with a CVSS score of 8.1, published 3 April 2026.

**Which products and versions are affected?** github.com/mattermost/focalboard (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=7.10.6; Mattermost Focalboard 8.0 and earlier.

**Is there a fix for CVE-2026-25773?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-25773 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-25773?** Check whether you run github.com/mattermost/focalboard (Go) or Mattermost Focalboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A second-order (time-based blind) SQL injection vulnerability exists in Focalboard version 8.0. The application fails to sanitize category IDs before they are stored in the database and subsequently used in dynamic SQL statements within the category reorder API. An authenticated attacker can submit a malicious SQL payload in the category ID field; when the reorder API later processes this stored value, the payload is executed. This allows for the exfiltration of sensitive data, such as user password hashes. As the standalone product is end-of-life, no fix is available.

## Affected products

- Mattermost Focalboard 8.0 and earlier

## Identifiers

- CVE-2026-25773
- GHSA-p32q-v29x-wq9r
- GO-2026-5524

## Timeline

- 2026-04-03: advisory: Vulnerability disclosed as unsupported when assigned

## References

- [https://github.com/mattermost-community/focalboard](https://github.com/mattermost-community/focalboard)

## Related threats

- [Mattermost Focalboard authorization bypass in file uploads](https://junglewise.ai/threats/cve-2026-28736-mattermost-focalboard-authorization-bypass-in-file-uploads)