CVE-2024-9333

Permission bypass in M-Files Connector for Copilot

State: Published
Severity: 5.3 Medium
Published: Oct 2, 2024
Updated: Feb 23, 2026
Reserved: Sep 30, 2024

Description

Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access control list calculation

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	M-Files Corporation

Weaknesses

CWE-281 Improper Preservation of Permissions

Affected Products

Product	Versions
M-Files Connector for CopilotM-Files Corporation	before 24.9.3Affected

References

https://product.m-files.com/security-advisories/cve-2024-9333/vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2024-9333vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.