Is CVE-2026-28736 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28736 being exploited in the wild.

How severe is CVE-2026-28736?

Medium severity, with a CVSS score of 4.3, published 3 April 2026.

Which products and versions are affected?

github.com/mattermost/focalboard (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=7.10.6; Mattermost Focalboard 8.0 and earlier.

Is there a fix for CVE-2026-28736?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-28736 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-28736?

Check whether you run github.com/mattermost/focalboard (Go) or Mattermost Focalboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28736: Mattermost Focalboard authorization bypass in file uploads

CVE-2026-28736 · Severity: medium · CVSS 4.3 · Published 2026-04-03

Mattermost Focalboard, a project management tool similar to Trello or Notion, contains a security flaw in how it handles file access. An authorized user of the system can view files uploaded by other users if they can guess or obtain the specific ID of that file. This could lead to the unauthorized exposure of sensitive documents or project data. Note that this product is no longer maintained, and no official security fix will be released.

Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-28736 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28736 being exploited in the wild.
How severe is CVE-2026-28736?: Medium severity, with a CVSS score of 4.3, published 3 April 2026.
Which products and versions are affected?: github.com/mattermost/focalboard (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=7.10.6; Mattermost Focalboard 8.0 and earlier.
Is there a fix for CVE-2026-28736?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-28736 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28736?: Check whether you run github.com/mattermost/focalboard (Go) or Mattermost Focalboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in Mattermost Focalboard version 8.0 and earlier. The application fails to perform proper authorization checks when serving uploaded files, specifically failing to validate that the requesting user has ownership or authorized access to the file associated with a given fileID. An authenticated attacker can exploit this by sending a direct request for a victim's fileID via the network. Successful exploitation results in unauthorized disclosure of file contents. As the standalone version of Focalboard is end-of-life (EOL), no patch is expected.

Affected products

Mattermost Focalboard 8.0 and earlier

Identifiers

CVE-2026-28736
GHSA-vph7-r229-qxpf
GO-2026-5670

Timeline

2026-04-03: disclosed: Vulnerability published in NVD
2026-04-03: advisory: Mattermost issued advisory noting the product is unsupported

References

https://github.com/mattermost-community/focalboard

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.