Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitized when the category reorder API processes the stored value. This Second-Order SQL Injection (Time-Based Blind) allows an authenticated attacker to exfiltrate sensitive data including password hashes of other users. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🔍 Today's Top Vulnerabilities 🟠 CVE-2026-25773 | CVSS 8.1 🟠 CVE-2026-27655 | CVSS 7.3 🟠 CVE-2026-4108 | CVSS 7.3 🔗 http://ctiwatch.cloud/vulnerabilities #CVE #Vulnerability #ThreatIntel
Post summary
The post lists three CVEs with their CVSS scores and a link to a generic vulnerabilities page, but gives no further details on exploitation, patches, or PoCs.
🟠 CVE-2026-25773 - High ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject ... https://www.thehackerwire.com/vulnerability/CVE-2026-25773/ https://t.co/tAxhS0lLbg
Post summary
The tweet announces CVE-2026-25773, revealing a SQL injection flaw in Focalboard 8.0 caused by unsanitized category IDs, and links to a vulnerability article for more details.
🚨*CVE* CVE-2026-25773 ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories… https://www.cve.org/CVERecord?id=CVE-2026-25773 ----- Traducción: CVE-2026-25773 ** … http://infoflow.cloud`
Post summary
The tweet announces that Focalboard 8.0 has a SQL injection vulnerability due to unsanitized category IDs, linking only to the CVE record.
CVE-2026-25773 ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories… https://www.cve.org/CVERecord?id=CVE-2026-25773
Post summary
The note identifies CVE-2026-25773 as a dynamic SQL injection risk in Focalboard v8.0 during category reordering, but does not provide a PoC, exploit, patch, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mattermost | focalboard | 8.0.0 | - | - |