Vulnerability · Published Apr 3, 2026 · Assigned by Mattermost

CVE-2026-25773Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix)

High 8.1

In plain English

A high-severity SQL injection in Focalboard from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 75.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitized when the category reorder API processes the stored value. This Second-Order SQL Injection (Time-Based Blind) allows an authenticated attacker to exfiltrate sensitive data including password hashes of other users. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/mattermost/focalboard	no fix listed	GHSA-p32q-v29x-wq9r
Go	github.com/mattermost/focalboard	no fix listed	GO-2026-5524

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Focalboard	0 – through 8.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Focalboard Repository (Unmaintained)