CVE-2026-25773 Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements
An authenticated attacker can exploit a second-order SQL injection in Focalboard to exfiltrate sensitive data, including password hashes, from the database.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25773?
CVE-2026-25773 is a high-severity SQL injection vulnerability in Mattermost Focalboard, published on 3 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitized when the category reorder API processes the stored value. This Second-Order SQL Injection (Time-Based Blind) allows an authenticated attacker to exfiltrate sensitive data including password hashes of other users. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.
Weakness: CWE-89
Which versions are affected by CVE-2026-25773?
3 open source packages ship an affected version, including github.com/mattermost/focalboard. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/mattermost/focalboard Go | All versions | None |
github.com/mattermost/focalboard Go | All versions to 7.10.6 | None |
github.com/mattermost/focalboard Go | All versions to 7.10.6 | None |
Products include Mattermost Focalboard.
How do I fix CVE-2026-25773?
Product is end of life, replace it.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-25773 being exploited?
There is no known exploitation of CVE-2026-25773 in the wild and no public exploit code.
Other vulnerabilities in Mattermost Focalboard
Sources
Also known as GHSA-p32q-v29x-wq9r, GO-2026-5524.