CVE-2026-28736

** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.

• CWE-639

• https://github.com/mattermost-community/focalboardProduct

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28728Local privilege escalation due to DLL hijacking vulnerabilit…6.7
• CVE-2026-28729Integer overflow in the UEFI firmware for the Intel(R) Slim …2.4
• CVE-2026-2873A vulnerability was detected in Tenda A21 1.0.0.0. This issu…8.8
• CVE-2026-28732Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…4.3
• CVE-2026-28733in OpenHarmony v6.0 and prior versions allow a local attacke…6.5
• CVE-2026-28735Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4…5.4
• CVE-2026-28737Gitea versions from 1.25.0 before 1.26.0 allow stored cross-…8.7
• CVE-2026-2874A flaw has been found in Tenda A21 1.0.0.0. Impacted is the …8.8
• CVE-2026-28740Gitea versions up to and including 1.26.2 allow Git LFS obje…7.1
• CVE-2026-28741Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 1…8.1
• CVE-2026-28742Naxclow devices use a uniform request-signing scheme based o…9.8
• CVE-2026-28744Gitea versions up to and including 1.26.1 allow Git smart HT…8.1