EUVD-2026-100524
GHSA-qhm6-5m7c-9h8g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as org admin/developer
-
ExploitObtain victim library-query identifier
-
ExecutionSend crafted execution request cross-org
-
ImpactExecute foreign query, exfiltrate or alter data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated account with administrator or developer privileges in at least one organization on a shared, multi-organization Lowcoder instance (version 2.1.0 through 2.4.10), plus knowledge or guessing of the victim organization's library-query identifier used in the crafted request to the library-query execution endpoint. Exploitation is limited to multi-tenant deployments and is bounded by the need for pre-existing authentication and a valid target query identifier; single-organization instances have no cross-tenant victim to target. |
| Impact | This is a credible but context-dependent priority rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) and 8.8 base score describe a low-complexity, network-reachable attack by an already-authenticated low-privileged user (admin or developer scoped to one organization), with high confidentiality, integrity, and availability impact because executing another organization's library query can expose or manipulate the data sources that query connects to. The EPSS score is very low (0.16%, 5th percentile), the issue is NOT on the CISA KEV list, and no public exploit was identified, so all three exploitation-likelihood signals agree that active or imminent widespread exploitation is unlikely at this time. The key limiting factor is that exploitation presupposes a valid account on a shared, multi-organization Lowcoder instance plus knowledge of a victim library-query identifier, so the realistic threat is a malicious or compromised insider/tenant in a multi-tenant deployment rather than an anonymous internet attacker. Note a metadata conflict: the single input Tag is 'Authentication Bypass', but the description and CWE-639 describe an authorization (cross-tenant IDOR) flaw by an already-authenticated user - this is an authorization bypass, not an authentication bypass; treat the tag with caution. |
| Exploit ScenarioDerived | A legitimate but malicious developer or administrator in Organization A on a shared Lowcoder instance obtains or guesses the library-query identifier belonging to Organization B. They send a crafted request to the library-query execution endpoint referencing that foreign identifier, causing the server to run Organization B's query against its configured data source and return or alter its data. No public exploit code was identified, so this would require the attacker to craft the request manually. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Cross-tenant authorization bypass in Lowcoder (versions 2.1.0 through and including 2.4.10) lets an authenticated administrator or developer from one organization execute a library query that belongs to a different organization by sending a crafted request containing the victim's library-query identifier to the library-query execution endpoint. The flaw yields full confidentiality, integrity, and availability impact against the targeted tenant's query data (CVSS 8.8, PR:L), but only on shared multi-organization deployments where the attacker already holds a privileged account and can determine a valid target identifier. No public exploit code and no CISA KEV activity have been identified at time of analysis, and EPSS is low at 0.16% (5th percentile), so this is a credible but context-dependent priority rather than a mass-exploitation threat.
RemediationAI
No vendor-released patch was identified in the supplied data at time of analysis, so remediation begins with tracking the CERT/CC note https://www.kb.cert.org/vuls/id/382143 and the upstream repository https://github.com/lowcoder-org/lowcoder for a fixed Lowcoder release and upgrading as soon as one is published. Where an immediate upgrade is not possible, reduce exposure with deployment-level controls: scope each organization to its own Lowcoder instance (splitting multi-tenant deployments eliminates the cross-tenant path entirely, at the cost of additional infrastructure and per-instance maintenance); tightly restrict who can hold the administrator and developer roles, since either is sufficient to trigger the flaw, and audit those grants (this lowers but does not remove risk, because the bypass is an authorization design issue rather than a privilege-level issue); and place a reverse-proxy or API-gateway rule in front of the library-query execution endpoint that rejects requests whose query identifier does not belong to the caller's organization, or restrict the endpoint to trusted networks, accepting that this requires custom identifier-to-tenant mapping logic and may break legitimate cross-workspace usage. Because exploitation generates abnormal cross-organization query executions, enable and review audit logging of library-query executions, alerting on executions by principals outside the query's owning organization. Rotating or otherwise protecting library-query identifiers is not a reliable mitigation, as identifiers may be enumerated or leaked through application responses.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Lowcoder is an open-source low-code application platform in which organizations (tenants) build apps backed by reusable 'library queries' - named, parameterized data-source queries stored server-side and addressed by an identifier. The platform's multi-tenant model assumes that an authenticated principal, even an administrator or developer holding elevated rights inside their own organization, is confined to that organization's objects. This CVE is CWE-639 (Authorization Bypass Through User-Controlled Key): the library-query execution endpoint accepts a client-supplied query identifier and resolves/executes it without verifying that the resolved query is scoped to the caller's organization, so the identifier itself becomes the authorization decision. Because the affected component is the query execution path rather than a read-only metadata API, a successful request returns query results and can also drive whatever side effects the underlying data source query performs, which is why impact is rated High across confidentiality, integrity, and availability. The attack surface is network-reachable (AV:N) with low complexity (AC:L), no user interaction, and a low-privilege authenticated precondition; no CPE strings were supplied in the input data, so exact affected product coverage should be confirmed against the CERT/CC advisory (VU#382143).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network endpoint reachable by any low-privileged authenticated user (PR:L) with no interaction; executing a foreign org's query yields full read/modify/disrupt impact on its data source, scope unchanged within the app.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
3DescriptionCVE.org
Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.
Executive ViewAI
Lowcoder versions 2.1.0 through 2.4.10 contain a cross-tenant authorization bypass that allows a privileged user (administrator or developer) in one organization to execute another organization's library queries, exposing, altering, or disrupting that tenant's query data. The exposure is limited to shared multi-organization deployments and requires the attacker to already hold an elevated account plus a valid target identifier, so it is a targeted trust-boundary risk rather than a mass-exploitation event. Leadership should care because a failure of tenant isolation in a shared platform directly undermines customer data-separation assurances and can trigger contractual, regulatory, and reputational consequences for any organization hosting multiple customers on the same instance.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict or disable the library-query execution endpoint for cross-tenant requests at the gateway or application layer, enforce server-side validation that the requesting user's organization matches the library query's owning organization, move sensitive tenants to dedicated (non-shared) Lowcoder instances, minimize and monitor administrator/developer role assignments, and alert on cross-organization library-query execution attempts in application logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB