M-Files Vulnerability Let Attacker Capture Session Tokens of Other Active Users

An authenticated information-disclosure vulnerability (CVE-2025-13008) in M-Files Server allows attackers with valid credentials to capture and reuse active users' session tokens, enabling impersonation, access to confidential documents, and potential lateral movement; multiple release branches are affected and patched versions are available, CVSS 4.0 base score 8.6, and no public exploits are currently reported.