An insider-driven token disclosure flaw that enables full user impersonation without passwords or alerts

Vulnerability Snapshot

What’s the Deal with This Vulnerability?

This issue is not a classic “external attacker breaks in from the internet” scenario. The real risk here comes from inside the organization.

Any user with valid M-Files credentials can potentially intercept active session tokens belonging to other users who are currently working in the M-Files Web interface. Once a session token is obtained, the attacker effectively becomes the victim from the server’s perspective.

With a stolen token, the attacker can:

• Access the victim’s vaults
• View confidential or sensitive documents
• Modify records and metadata
• Perform actions using the victim’s permissions

No password is required, and no re-authentication occurs. From the system’s point of view, everything looks legitimate because the session credentials are valid. As a result, traditional authentication controls and login monitoring provide little to no warning.

Technical Classification (MITRE Mapping)

How Could This Be Exploited?

In simple terms, an attack could unfold as follows:

1. Attacker logs in legitimately
   The attacker already has a valid M-Files account (for example, a malicious insider, contractor, or compromised user).
2. Victim is actively working
   Another user is using M-Files Web and performing specific client-side operations.
3. Session token interception occurs
   Due to insufficient session token protection in M-Files Web, the attacker is able to capture the victim’s active session token.
4. Identity takeover
   Using the stolen token, the attacker impersonates the victim and gains access to all vaults, documents, and actions allowed by the victim’s role.
5. No alarms are triggered
   Since no password guessing or authentication bypass occurs, logs show legitimate session activity rather than an intrusion attempt.

Important caveat:
The victim must be actively performing certain operations in M-Files Web for the attack window to exist. This is not a passive, always-on token harvesting flaw. However, in organizations where users remain logged in for long periods throughout the day, the practical exposure window can still be significant.

Which Versions Are Affected?

You are vulnerable if your environment is running any of the following versions:

• M-Files Server before 25.12.15491.7
• M-Files Server before LTS 25.8 SR3 (25.8.15085.18)
• M-Files Server before LTS 25.2 SR3 (25.2.14524.14)
• M-Files Server before LTS 24.8 SR5 (24.8.13981.17)

Proof of Concept (PoC) Status

There is currently no public proof-of-concept available. This vulnerability was responsibly disclosed, and no exploit code has been released.

That said, session token interception is a well-understood technique. A capable attacker could develop their own exploit based solely on the technical description. While M-Files rates the likelihood of exploitation as LOW, this should not be interpreted as low risk. The potential impact is severe, and patching should not be delayed.

How to Detect Exploitation Attempts

Key Indicators to Hunt For

Monitor your environment for the following red flags:

• Concurrent sessions from different IP addresses
  The same user account active from multiple IPs at the same time, especially when one IP is unfamiliar.
• Impossible travel scenarios
  Sessions originating from geographically distant locations within an unrealistic timeframe (e.g., New York and Tokyo within minutes).
• Unusual access patterns
  A user suddenly accessing vaults or documents they have never interacted with before, particularly sensitive content.
• Session anomalies
  Sudden changes in user-agent strings, browser fingerprints, or device characteristics during an active session.
• Privilege misuse indicators
  Actions that align with the victim’s permissions but match the attacker’s typical behavioral patterns.

Log Sources to Monitor

Detection Rule Logic (Pseudo-code)

// Concurrent Session Detection
IF user.session_id = active_session.id
AND source_ip != original_session.ip
AND time_difference < 5 minutes
THEN alert('Possible Session Hijacking - CVE-2025-13008')

SOC Action Items – What to Do Right Now

Immediate Actions

1. Identify all M-Files Server deployments
   Coordinate with IT and infrastructure teams to inventory all installations and versions.
2. Prioritize patching
   Upgrade immediately to 25.12.15491.7 or the appropriate patched LTS release.
3. Audit existing sessions
   Review historical and current M-Files Web access logs for signs of session hijacking.
4. Enable enhanced logging
   Activate Advanced Event Logging and User Action Logs to improve visibility.

Compensating Controls (Until Patched)

• IP-based session binding
  Where feasible, bind sessions to known IP ranges or subnets.
• Reduce session timeouts
  Shorten idle session lifetimes to limit token exposure.
• User awareness
  Encourage users to log out when not actively using M-Files Web.
• Network segmentation
  Restrict M-Files Web access to trusted network zones whenever possible.

Related Vulnerability: CVE-2025-14267

M-Files also disclosed a second issue during the same timeframe:

What happens:
When an administrator copies a vault using the “metadata structure only” option, cached activity data is not fully cleaned. This may expose file names, user names, and comments from the source vault.

Affected Versions:

• M-Files Server before 25.12.15491.7

Good news:
Upgrading to the patched version automatically removes the cached data during the database update. No additional remediation is required beyond patching.

Official Patch Information

Patched versions are available from official M-Files sources:

• M-Files Product Downloads:
  https://product.m-files.com/downloads/
• CVE-2025-13008 Advisory:
  https://product.m-files.com/security-advisories/cve-2025-13008/
• CVE-2025-14267 Advisory:
  https://product.m-files.com/security-advisories/cve-2025-14267/

Bottom Line

CVE-2025-13008 represents a high-severity insider threat that allows authenticated users to hijack active sessions and fully impersonate other users. While no public exploit currently exists and the likelihood of exploitation is rated low, the impact is severe: complete identity impersonation with all associated privileges.

A fix is available, and delaying patching only increases risk as technical details are now public.

⚠ Priority: Patch M-Files Server immediately. Actively monitor for suspicious session behavior and apply compensating controls if patching cannot be performed right away.