GHSA-vph7-r229-qxpf
Focalboard doesn't validate file ownership when serving uploaded files
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/focalboard | <= 7.10.6 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.
References
External links from the advisory. They lead to third-party sites.