Mattermost Focalboard

• CVE-2026-28736 Medium 4.3 Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix) 0.2%
• CVE-2026-25773 High 8.1 Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix) 0.3%