M-Files Vulnerability Let Attacker Capture Session Tokens of Other Active Users
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
An information disclosure vulnerability in M-Files Server enables authenticated attackers to capture and reuse session tokens<\/a> from active users. Potentially gaining unauthorized access to sensitive document management systems.<\/p>\n The flaw, tracked as CVE-2025-13008, affects multiple versions across different release branches and carries a high-severity CVSS 4.0 base score of 8.6.<\/p>\n The vulnerability exists within M-Files Web and requires the attacker to have legitimate authentication credentials.<\/p>\n Once authenticated, an attacker can intercept session tokens of other actively connected users while they perform specific client operations.<\/p>\n By obtaining these tokens, threat actors<\/a> can impersonate legitimate users and execute actions in their name and with their permissions.<\/p>\n Including accessing confidential documents and potentially modifying critical information.<\/p>\n The flaw is classified as CWE-359<\/a> (Exposure of Private Personal Information to an Unauthorized Actor). It represents a session replay scenario per CAPEC-60.<\/p>\n The attack requires user interaction and network accessibility, making it a practical threat in connected environments.<\/p>\n Organizations running the following M-Files Server versions are vulnerable and should prioritize patching:<\/p>\nAffected Versions<\/strong><\/h2>\n