What is the CVSS score of CVE-2026-55664?

CVE-2026-55664 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-55664?

Yes, a patch is available for CVE-2026-55664. Update the affected software to the latest version immediately.

Grist Core CVE-2026-55664

EUVD-2026-43046 MEDIUM

Information Exposure (CWE-200)

2026-07-10 GitHub_M

Python Information Disclosure Grist Core Gristlabs

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

The description explicitly includes unauthenticated public users on public documents, warranting PR:N; confidentiality impact is low as only schema metadata, not row data, is disclosed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 22:10 vuln.today

Patch available

Jul 10, 2026 - 22:02 EUVD

DescriptionCVE.org

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actually a form. A user with only partial read access, including public access on a publicly viewable document, could request the metadata of any widget and reveal table and column structure that access rules would otherwise hide, even in documents that contain no forms. This issue is fixed in version 1.7.15.

AnalysisAI

Unauthorized schema disclosure in Grist Core prior to 1.7.15 allows any user with partial read access - explicitly including anonymous public users on publicly viewable documents - to retrieve table and column metadata for any widget by querying the GET /forms endpoint. The endpoint failed both to validate that the requested section was a form widget and to apply the document's configured access rules before returning metadata, meaning hidden schema structure (table names, column names, types) is fully exposed regardless of the restrictions in place. No public exploit has been identified and the vulnerability is not in CISA KEV; a vendor-released patch exists in version 1.7.15.

Technical ContextAI

Grist is an open-source spreadsheet application (CPE: cpe:2.3:a:gristlabs:grist-core:*:*:*:*:*:*:*:*) that uses Python as its formula language and implements document-level access control rules to restrict which tables and columns particular users may read. The GET /forms endpoint was introduced to serve metadata for form widgets embedded in documents. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the endpoint performed no authorization gating - it did not check whether the caller's access rules permitted reading the queried section's metadata, nor did it validate that the referenced section was actually a form widget rather than an arbitrary table/column widget. This allowed the endpoint to function as an unrestricted schema introspection API for any caller who could reach the document at all, including the public.

RemediationAI

Upgrade grist-core to version 1.7.15, which is the vendor-confirmed fix per the GitHub release tag at https://github.com/gristlabs/grist-core/releases/tag/v1.7.15 and the security advisory at https://github.com/gristlabs/grist-core/security/advisories/GHSA-w2hc-w6cg-xvh9; the specific patch commit is https://github.com/gristlabs/grist-core/commit/14694156fe99c438c5f7a452ad367e933bb194db. For administrators unable to patch immediately, restricting network-level access to the Grist instance so only trusted, authenticated users can reach the application will eliminate the public-user attack surface; the trade-off is loss of legitimate public document sharing functionality. There is no known configuration toggle to disable the /forms endpoint independently without patching.