The vulnerability resides in Focalboard version 8.0, where the file content endpoint fails to verify that the requesting user owns the file. An authenticated user who knows another user’s file ID can download that file, exposing confidential information. This represents an Insecure Direct Object Reference (IDOR) that allows the disclosure of data but does not grant code execution or system compromise.

Mattermost’s standalone Focalboard product, specifically version 8.0, is affected. The product is currently unsupported and no fix will be issued, meaning the flaw remains unpatched in any existing installations.

With a CVSS score of 4.3, the flaw carries moderate severity and poses a moderate risk to confidentiality. The Exploit Predictability Score (EPSS) is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploitation yet. An attacker requires authenticated access to the system and knowledge of file IDs, limiting exploitation to internal or compromised users rather than remote attackers.