Identity Theft in M-Files: High-Severity Flaw Lets Insiders Hijack User Accounts and Access Sensitive Data

According to product.m-files[.]com/security-advisories/cve-2025-13008/, M-Files faces two vulnerabilities, the most severe of which could allow a malicious insider to silently steal colleagues’ digital identities and gain full access to sensitive data under another user’s account.

The headline flaw, CVE-2025-13008, is a high-severity session token disclosure with a CVSS of 8.6, and it enables an authenticated attacker to capture active session tokens and impersonate other users to view confidential documents and perform actions with their privileges.

The second vulnerability, CVE-2025-14267, is moderate in severity (CVSS 5.6) and occurs when copying a document vault’s metadata structure; due to incomplete scrubbing of temporary cache data, information from the source vault can bleed into the new copy. The firm states that the issues affect various M-Files Server versions including pre-25.12.15491.7 and several LTS releases such as 25.8 LTS SR3, 25.2 LTS SR3, and 24.8 LTS SR5, and has issued updates to address both flaws. Administrators are urged to upgrade to version 25.12.15491.7 or newer to mitigate the risk.