A second‑order SQL injection vulnerability exists in the category reorder endpoint of Focalboard version 8.0. An attacker who is authenticated can add a malicious SQL payload to the category identifier field. The payload is stored in the database and later executed unsanitized when the reorder API processes the stored value. This time‑based blind injection can retrieve sensitive data, including password hashes of other users. The flaw is a classic SQL injection weakness (CWE‑89).

The affected product is Mattermost Focalboard, and the vulnerability applies specifically to version 8.0. The standalone product is no longer maintained and no fix will be released. Any deployment of this version that allows authenticated access to the category reorder API is impacted.

The CVSS base score of 8.1 marks this flaw as high severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Because an attacker must be authenticated to trigger the injection, the attack vector is localhost or within the trusted environment of the application. Once exploited, the attacker can read confidential data from the database, potentially leading to credential compromise and further lateral movement. No official patch is available, so the risk remains significant for any vulnerable installation.