CVE-2026-28736

CVE-2026-28736 describes a medium-severity vulnerability in Focalboard version 8.0, where the application fails to validate file ownership for uploaded files. This flaw allows an authenticated attacker, with knowledge of a file's ID, to read its contents, resulting in a low impact on confidentiality with low attack complexity. The attack can be performed over the network without user interaction. There is currently no evidence of active exploitation, nor are public exploit tools or community discussions available. It is important to note that Focalboard as a standalone product is unmaintained, and no patch will be issued for this vulnerability.