CVE-2026-25773

{"id": "CVE-2026-25773", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "responsibledisclosure@mattermost.com"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25773", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T14:56:18.578517Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "responsibledisclosure@mattermost.com", "affectedData": [{"vendor": "Mattermost", "product": "Focalboard", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-03T14:16:29.127", "references": [{"url": "https://github.com/mattermost-community/focalboard", "tags": ["Product"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitized when the category reorder API processes the stored value. This Second-Order SQL Injection (Time-Based Blind) allows an authenticated attacker to exfiltrate sensitive data including password hashes of other users. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued."}, {"lang": "es", "value": "NO COMPATIBLE CUANDO SE ASIGNA Focalboard versi\u00f3n 8.0 no logra sanear los IDs de categor\u00eda antes de incorporarlos en sentencias SQL din\u00e1micas al reordenar categor\u00edas. Un atacante puede inyectar una carga \u00fatil SQL maliciosa en el campo de ID de categor\u00eda, que se almacena en la base de datos y luego se ejecuta sin sanear cuando la API de reordenaci\u00f3n de categor\u00edas procesa el valor almacenado. Esta inyecci\u00f3n SQL de segundo orden (ciega basada en tiempo) permite a un atacante autenticado exfiltrar datos sensibles, incluyendo hashes de contrase\u00f1as de otros usuarios. NOTA: Focalboard como producto independiente no recibe mantenimiento y no se emitir\u00e1 ninguna correcci\u00f3n."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:focalboard:8.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42087E46-C9CC-46D7-B424-55537457FE0A"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}