CVE-2026-25773

** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitized when the category reorder API processes the stored value. This Second-Order SQL Injection (Time-Based Blind) allows an authenticated attacker to exfiltrate sensitive data including password hashes of other users. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mattermost-community/focalboard	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:mattermost:focalboard:8.0.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-03 14:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-25773

Mitre link : CVE-2026-25773

CVE.ORG link : CVE-2026-25773

JSON object : View

Products Affected

mattermost

focalboard

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-25773", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "responsibledisclosure@mattermost.com"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25773", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T14:56:18.578517Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "responsibledisclosure@mattermost.com", "affectedData": [{"vendor": "Mattermost", "product": "Focalboard", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-03T14:16:29.127", "references": [{"url": "https://github.com/mattermost-community/focalboard", "tags": ["Product"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitized when the category reorder API processes the stored value. This Second-Order SQL Injection (Time-Based Blind) allows an authenticated attacker to exfiltrate sensitive data including password hashes of other users. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued."}, {"lang": "es", "value": "NO COMPATIBLE CUANDO SE ASIGNA Focalboard versi\u00f3n 8.0 no logra sanear los IDs de categor\u00eda antes de incorporarlos en sentencias SQL din\u00e1micas al reordenar categor\u00edas. Un atacante puede inyectar una carga \u00fatil SQL maliciosa en el campo de ID de categor\u00eda, que se almacena en la base de datos y luego se ejecuta sin sanear cuando la API de reordenaci\u00f3n de categor\u00edas procesa el valor almacenado. Esta inyecci\u00f3n SQL de segundo orden (ciega basada en tiempo) permite a un atacante autenticado exfiltrar datos sensibles, incluyendo hashes de contrase\u00f1as de otros usuarios. NOTA: Focalboard como producto independiente no recibe mantenimiento y no se emitir\u00e1 ninguna correcci\u00f3n."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:focalboard:8.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42087E46-C9CC-46D7-B424-55537457FE0A"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}