PT-2026-30041 · Unknown · Focalboard

CVE-2026-25773 · Published 2026-04-03 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Focalboard version 8.0

Description Focalboard version 8.0 does not properly sanitize category IDs before using them in SQL queries when reordering categories. This can allow an attacker to inject malicious SQL code into the category ID field, which is then executed without proper sanitization when the category reorder API processes the stored value. This Second-Order SQL Injection (Time-Based Blind) could allow an authenticated attacker to obtain sensitive data, including password hashes of other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-25773

GHSA-P32Q-V29X-WQ9R

GO-2026-5524

Affected Products

Focalboard

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25773.json · Exploit
• https://osv.dev/vulnerability/GO-2026-5524 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p32q-v29x-wq9r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25773 · Security Note
• https://github.com/mattermost-community/focalboard · Note
• https://twitter.com/TheHackerWire/status/2040342924760908075 · Twitter Post
• https://t.me/cveNotify/161171 · Telegram Post
• https://twitter.com/CVEnew/status/2040111921417134145 · Twitter Post
• https://twitter.com/infoflowcloud/status/2040113614812582285 · Twitter Post
• https://github.com/advisories/GHSA-p32q-v29x-wq9r · Note