PT-2026-30041 · Unknown · Focalboard

Published 2026-04-03 · Updated 2026-04-28 · CVE-2026-25773

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Focalboard version 8.0

Description Focalboard version 8.0 does not properly sanitize category IDs before using them in SQL queries when reordering categories. This can allow an attacker to inject malicious SQL code into the category ID field, which is then executed without proper sanitization when the category reorder API processes the stored value. This Second-Order SQL Injection (Time-Based Blind) could allow an authenticated attacker to obtain sensitive data, including password hashes of other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-25773

GHSA-P32Q-V29X-WQ9R

Affected Products

Focalboard

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-25773 · Security Note
• https://osv.dev/vulnerability/GHSA-p32q-v29x-wq9r · Vendor Advisory
• https://github.com/mattermost-community/focalboard · Note
• https://twitter.com/TheHackerWire/status/2040342924760908075 · Twitter Post
• https://twitter.com/infoflowcloud/status/2040113614812582285 · Twitter Post
• https://t.me/cveNotify/161171 · Telegram Post
• https://twitter.com/CVEnew/status/2040111921417134145 · Twitter Post