Mattermost Focalboard vulnerabilities

• mattermost focalboard Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix) CVE-2026-28736 4.3 MediumApril 3, 2026
• mattermost focalboard Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix) CVE-2026-25773 8.1 HighApril 3, 2026