Executive brief
Mattermost Focalboard, a project management tool similar to Trello or Notion, contains a security flaw in how it handles file access. An authorized user of the system can view files uploaded by other users if they can guess or obtain the specific ID of that file. This could lead to the unauthorized exposure of sensitive documents or project data. Note that this product is no longer maintained, and no official security fix will be released.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Mattermost Focalboard version 8.0 and earlier. The application fails to perform proper authorization checks when serving uploaded files, specifically failing to validate that the requesting user has ownership or authorized access to the file associated with a given fileID. An authenticated attacker can exploit this by sending a direct request for a victim's fileID via the network. Successful exploitation results in unauthorized disclosure of file contents. As the standalone version of Focalboard is end-of-life (EOL), no patch is expected.
Affected products
- Mattermost Focalboard 8.0 and earlier
Timeline
- 2026-04-03: disclosed: Vulnerability published in NVD
- 2026-04-03: advisory: Mattermost issued advisory noting the product is unsupported