Blind Server-Side Request Forgery Vulnerability in M-Files Document Co-Authoring Features
CVE-2026-0932

6.9MEDIUM

Key Information:

Vendor

M-files Corporation

Status
M-files Server
Vendor
CVE Published:
1 April 2026

What is CVE-2026-0932?

A blind server-side request forgery (SSRF) vulnerability exists in the legacy connection methods of document co-authoring features in M-Files Server versions prior to 26.3. This flaw allows unauthenticated attackers to manipulate the server into making HTTP GET requests to arbitrary URLs. Exploitation of this vulnerability could lead to exposure of sensitive information and unauthorized actions within the network.

Affected Version(s)

M-Files Server 0 < 26.3.15818.5

References

https://empower.m-files.com/security-advisories/CVE-2026-...
vendor-advisory
https://product.m-files.com/security-advisories/cve-2026-...
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sina Kheirkhah (SinSinology) of watchTowr (watchTowrcyber)
.