Permission bypass in M-Files Connector for Copilot
Priority LOW 24CWE-281Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access control list calculation
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Fix Fixed M-Files Connector for Copilot (M-Files Corporation): 24.9.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| M-Files Corporation | M-Files Connector for Copilot | before 24.9.3 | 24.9.3 | Patch available | CNA |
- M-Files Connector for Copilot VendorM-Files Corporation Affected before 24.9.3 Fixed in 24.9.3 Patch available CNA
Remediation
- Fix · CNA M-Files Connector for Copilot (M-Files Corporation) Fixed in 24.9.3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-9333
- 2026-10-03 Alias added: GHSA-9hv6-whj4-wpw5
References
More M-Files Corporation vulnerabilities
- TI-2021-15287 M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in… CVSS 3.1HIGH 7.5
- TI-2025-05387 Path traversal in M-Files API CVSS 4.0HIGH 8.4
- TI-2024-09388 Support for authentication bypass condition in M-Files LDAP authentication CVSS 4.0CRITICAL 9.2
- TI-2023-06317 Brute force vulnerability in M-Files user authentication CVSS 3.1CRITICAL 9.8
- TI-2021-18438 Missing brute-force protection in M-Files Server CVSS 3.1CRITICAL 9.8
- TI-2025-11909 Session Token Disclosure in M-Files Web CVSS 4.0HIGH 8.6
Sources
- CVE-2024-9333 · CVE Program
- CVE-2024-9333 · NVD
- FIRST EPSS
- GHSA-9hv6-whj4-wpw5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences