M-Files Vulnerability Allows Attackers to Capture Session Tokens of Active Users

A critical security vulnerability in M-Files Server poses a significant risk to enterprise environments by allowing authenticated attackers to capture and steal active user session tokens through the M-Files Web interface.

The flaw, designated CVE-2025-13008, was publicly disclosed on December 19, 2025, and could enable attackers to impersonate legitimate users and gain unauthorized access to sensitive information.

The vulnerability stems from inadequate session token protection mechanisms in M-Files Web.

Attackers with valid credentials can intercept other users’ session tokens while they are actively using the platform, effectively hijacking their identities and permissions.

Once a token is compromised, an attacker can perform privileged actions, access confidential documents, modify critical records, and execute operations without raising suspicion, effectively bypassing traditional authentication controls that rely on password-based security.

The attack vector requires victims to perform specific client operations, creating a narrow but exploitable window during active sessions.

This makes the vulnerability particularly dangerous in organizations where users maintain continuous M-Files Web sessions throughout the workday.

Unlike password compromise, session token theft leaves minimal traces because attackers use valid credentials rather than forcing authentication.

Affected Versions and CVSS Score

M-Files Server versions before 25.12.15491.7 are vulnerable, along with multiple Long-Term Support (LTS) releases.

The vulnerability carries a CVSS 4.0 base score of 8.6, indicating high severity. The flaw is categorized as CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor) and mapped to CAPEC-60 (Reusing Session IDs/Session Replay), which highlights the attack methodology.

Organizations deploying M-Files Server must prioritize urgent patching. Security teams should immediately upgrade to the patched versions and implement comprehensive monitoring for suspicious session activity.

Audit M-Files Web access logs for authentication anomalies, unusual token usage patterns, and concurrent session activities from unexpected locations.

Implement additional security controls, such as IP-based session binding and real-time token validation, until all systems are fully patched.

While no public exploitation has been documented, the responsible disclosure timeline suggests attackers may soon develop active exploits.

Given the high severity and ease of exploitation for authenticated users, rapid remediation is essential to prevent potential data breaches and unauthorized access.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyber Press as a Preferred Source in Google.