CVE-2026-28736: Focalboard Information Disclosure Flaw

CVE-2026-28736 Overview

CVE-2026-28736 is an Insecure Direct Object Reference (IDOR) vulnerability in Focalboard version 8.0 that allows authenticated attackers to access files belonging to other users. The application fails to validate file ownership when serving uploaded files, enabling any authenticated user who knows or can guess a victim's fileID to read the contents of their files.

This vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), which occurs when an application uses user-supplied input to directly access objects without proper authorization checks.

Critical Impact

Authenticated attackers can read arbitrary user files by manipulating file identifiers, leading to unauthorized information disclosure. Note: Focalboard as a standalone product is no longer maintained and no fix will be issued.

Affected Products

• Focalboard version 8.0
• Focalboard standalone installations (unsupported)

Discovery Timeline

• 2026-04-03 - CVE-2026-28736 published to NVD
• 2026-04-03 - Last updated in NVD database

Technical Details for CVE-2026-28736

Vulnerability Analysis

This vulnerability stems from insufficient authorization controls in Focalboard's file serving mechanism. When a user uploads a file to Focalboard, the application assigns it a unique fileID. However, when another user requests a file by its fileID, the application fails to verify whether the requesting user is authorized to access that particular file.

The core issue is that file access decisions rely solely on knowledge of the fileID rather than validating the relationship between the requesting user and the file owner. This creates a broken access control scenario where any authenticated user can potentially access any uploaded file in the system.

Root Cause

The root cause is a missing ownership validation check in the file retrieval functionality. When processing file access requests, the application authenticates the user but does not authorize the specific file access operation. The code path responsible for serving files accepts the fileID parameter without verifying that the authenticated user has permission to access the requested file resource.

This is a classic IDOR (Insecure Direct Object Reference) pattern where:

1. Files are referenced by predictable or enumerable identifiers
2. Authentication is required but authorization is not enforced
3. The application assumes that possession of a valid fileID implies authorization

Attack Vector

An attacker can exploit this vulnerability through the following attack flow:

1. The attacker obtains valid authentication credentials for the Focalboard application
2. The attacker uploads their own file to observe the fileID format and structure
3. Through enumeration, social engineering, or observation of network traffic, the attacker obtains or guesses a victim's fileID
4. The attacker crafts a request to the file serving endpoint with the victim's fileID
5. The server returns the file contents without validating ownership

The attack is network-accessible and requires low privileges (authenticated user status) with no user interaction required. The impact is limited to confidentiality exposure of uploaded files.

Detection Methods for CVE-2026-28736

Indicators of Compromise

• Unusual file access patterns where a single user account requests files belonging to multiple different users
• HTTP requests to file endpoints with sequential or enumerated fileID values
• Access logs showing authenticated users retrieving files they did not upload
• Increased volume of file retrieval requests from individual user sessions

Detection Strategies

• Monitor file access logs for cross-user file retrieval patterns where the requesting user differs from the file owner
• Implement anomaly detection for users accessing files outside their normal scope
• Review web server access logs for brute-force or enumeration attempts against file endpoints
• Deploy web application firewall (WAF) rules to detect rapid sequential requests to file endpoints

Monitoring Recommendations

• Enable detailed access logging for the Focalboard file serving endpoint
• Configure alerts for users accessing files belonging to other users or teams
• Implement rate limiting on file retrieval endpoints to slow enumeration attempts
• Review authentication logs in conjunction with file access logs to correlate suspicious activity

How to Mitigate CVE-2026-28736

Immediate Actions Required

• Evaluate the sensitivity of files stored in Focalboard and consider migrating critical data to supported platforms
• Migrate from standalone Focalboard to Mattermost Boards (the maintained successor) if continuing use is required
• Implement network-level access controls to limit who can reach the Focalboard instance
• Conduct an audit of files currently stored in the system to identify sensitive content

Patch Information

No patch is available. Focalboard as a standalone product is no longer maintained by the Mattermost community. Organizations using Focalboard should migrate to alternative solutions.

For more information about the Focalboard project status, see the GitHub Focalboard Project Repository.

Workarounds

• Restrict network access to Focalboard instances using firewall rules or VPN requirements
• Implement a reverse proxy with additional authorization checks before the Focalboard file endpoint
• Remove or migrate sensitive files from the Focalboard system to more secure storage
• Consider deploying Mattermost Boards, which integrates Focalboard functionality with active security support
• Limit user registration and access to only trusted users within your organization