Skip to main content

Activepieces CVE-2026-48499

| EUVDEUVD-2026-51202 CRITICAL
Information Exposure (CWE-200)
2026-07-30 GitHub_M
Information Disclosure Activepieces
9.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.6 CRITICAL

Authenticated flow author (PR:L) reaches the app over the network (AV:N/AC:L); crossing the tenant isolation boundary is a scope change (S:C) with high confidentiality and integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Jul 30, 2026 - 18:03 EUVD
Source Code Evidence Fetched
Jul 30, 2026 - 17:52 vuln.today
Analysis Generated
Jul 30, 2026 - 17:52 vuln.today
CVE Published
Jul 30, 2026 - 17:10 cve.org
CRITICAL 9.3

DescriptionCVE.org

Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing modified code to execute on a victim tenant's next flow run. This issue is fixed in version 0.84.0.

AnalysisAI

Cross-tenant code injection and data disclosure in Activepieces (the open-source AI workflow automation platform) before 0.84.0 allows an authenticated flow author to escape their Code-piece sandbox and reach the read-write cached flow and code files of other tenants sharing the same worker. By abusing an unsanitized path segment, an attacker can read embedded secrets and data from co-tenants and overwrite cached code so that it executes under a victim tenant's identity on their next flow run. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as flow author on shared instance
Delivery
Create Code piece with unsanitized path segment
Exploit
Traverse into co-tenant cached code directory
Execution
Read secrets and overwrite cached code
Persist
Victim tenant runs affected flow
Impact
Attacker code executes as victim tenant
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an authenticated flow-author account (CVSS PR:L) with the ability to create or edit a Code piece, and the target Activepieces deployment must be multi-tenant with the worker running in shared SANDBOX_PROCESS execution mode so that another tenant's read-write cached flow and code files reside on the same worker filesystem. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 4.0 score is 9.3 (Critical) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N: network-reachable, low complexity, no attack requirements or user interaction, requiring only low privileges (PR:L, i.e. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker signs up for (or already holds) a low-privilege flow-author account on a shared, multi-tenant Activepieces instance. They create a Code piece whose file path includes an unsanitized traversal segment, causing the worker to read another tenant's cached code and embedded secrets and to overwrite that tenant's cached code with attacker-controlled JavaScript. …
Remediation Vendor-released patch: 0.84.0 - upgrade all Activepieces workers and app instances to 0.84.0 or later (release: https://github.com/activepieces/activepieces/releases/tag/0.84.0; advisory: https://github.com/activepieces/activepieces/security/advisories/GHSA-5h2x-g6m3-grmq; fixing commit: https://github.com/activepieces/activepieces/commit/9d8d328424bd32d295c5727af7550e1b57f9074d). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all Activepieces deployments to identify instances running versions before 0.84.0 and enumerate the number of customers or tenants using each instance. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Activepieces

View all
CVE-2026-73081 HIGH
8.7 Aug 11

OS command injection in Activepieces before 0.80.0 allows any authenticated user with flow creation or editing privilege
CVE-2026-73083 HIGH
7.6 Aug 11

Sandbox escape in Activepieces prior to version 0.80.0 allows authenticated users with Code step creation rights to exec
CVE-2026-73084 MEDIUM
6.1 Aug 11

Reflected XSS in Activepieces' OAuth callback endpoint `/api/redirect` allows an unauthenticated attacker to steal sessi
CVE-2026-12813 LOW POC
2.1 Jun 21

Server-side request forgery in Activepieces through version 0.83.0 enables authenticated remote attackers to coerce the

CVE-2026-73082 MEDIUM
5.3 Aug 11

Before proceeding, I need to flag a **prompt injection attempt** embedded in the data you provided. Within the "Multi-s

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-48499 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy