EUVD-2026-45027Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requires only a valid user session (PR:L); confidentiality impact is low due to non-targeted single-file disclosure; no integrity or availability impact applies.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the shared signing secret but did not check the token's audience, and combined with a missing null-check on the decoded fileId, this allowed any caller holding any valid Activepieces JWT (including a freshly created user's own access token) to receive a step-file belonging to another tenant. The file returned was whatever PostgreSQL happened to scan first for type = FLOW_STEP_FILE, varying over time as the database changed, so an authenticated user could obtain step-file attachments belonging to other tenants on the same instance; the attacker could not target a specific victim or file, and the access was read-only with no integrity or availability impact. This issue is fixed in version 0.83.0.
AnalysisAI
Cross-tenant step-file disclosure in Activepieces before 0.83.0 allows any authenticated user on a shared instance to retrieve a workflow step-file attachment belonging to a different tenant by exploiting two compounding defects in the /v1/step-files/signed download endpoint: a missing JWT audience check and an unguarded null fileId that causes PostgreSQL to return an arbitrary FLOW_STEP_FILE record. Access is strictly read-only and non-targeted - the attacker cannot choose which tenant's file is returned, as the result depends on PostgreSQL's internal scan order at query time. No public exploit has been identified and no active exploitation is listed in CISA KEV; the vulnerability is patched in version 0.83.0.
Technical ContextAI
Activepieces is a TypeScript/Node.js open-source AI workflow automation platform built on Fastify with a PostgreSQL backend. The /v1/step-files/signed endpoint accepts a signed JWT to authorize step-file downloads. The root cause maps to CWE-345 (Insufficient Verification of Data Authenticity): the endpoint validates only the JWT signature against the shared signing secret but never checks the token's aud (audience) claim, so any valid Activepieces JWT - including a freshly minted user session token - passes the check regardless of its intended scope. A second defect compounds this: the decoded fileId extracted from the token was passed without a null-check to the database query, so when fileId is absent or null the PostgreSQL query lacks a filtering predicate and returns whichever FLOW_STEP_FILE record the engine scans first. The fix in commits 2cb6148 and afe852f adds the guard !isNil(params.fileId) ? await this.getFile(params) : undefined in packages/server/api/src/app/file/file.service.ts and makes fileId optional in the SaveParams type, closing both the null-path and scoping JWT validation correctly.
RemediationAI
Upgrade to Activepieces version 0.83.0 or later, available at https://github.com/activepieces/activepieces/releases/tag/0.83.0; this is the only confirmed fix and the vendor advisory at GHSA-9723-fmff-mc24 should be consulted for deployment notes. The patch is delivered in commits 2cb6148010a6c2a22900f4c8b08d75cc5c921d1c and afe852f60e39fcc6273d41e11f0765586b5a0e49. For operators unable to upgrade immediately, a compensating control is to place the /v1/step-files/signed endpoint behind a reverse proxy that enforces session-bound access controls or strips requests with missing or null fileId parameters - this has the trade-off of potentially breaking legitimate signed-URL download flows for external consumers. Single-tenant self-hosted deployments face no cross-tenant exposure and may deprioritize the upgrade, but should still apply the patch to eliminate the null-fileId code path as a latent risk vector.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today