CVE-2022-4861: Incorrect Implementation of Authentication Algorithm

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-30 · updated 2026-06-17
Weakness: CWE-303

Description

Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource.

Affected products

M-Files Client: before 22.5.11356.0 — fixed in 22.5.11356.0

How to fix

Upgrade to a fixed version: M-Files Client 22.5.11356.0. Check the vendor advisory for mitigations.

References

https://empower.m-files.com/security-advisories/CVE-2022-4861
https://product.m-files.com/security-advisories/cve-2022-4861/
https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4861/
https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4861/

Get alerted when CVE-2022-4861 or the next vulnerability affects your stack