Grist Core CVE-2026-55664

Exploitation requires network access to a Grist instance running grist-core prior to 1.7.15. For publicly viewable documents, no authentication is required - public (anonymous) access is sufficient, meaning the effective attack surface includes any internet-facing Grist instance with at least one public document. For non-public documents, a low-privileged account with partial read access to the document is required (CVSS PR:L). The attacker must supply a valid section ID, which can be observed from normal document URLs or enumerated. Exploitation is meaningfully impactful only when the target document has access rules configured to hide specific tables or columns - instances with no access rules configured are not adversely affected by this bypass. The impact is strictly limited to schema metadata (table and column structure); row-level data content is not exposed.

The official CVSS 3.1 score of 4.3 (Medium) uses PR:L, reflecting that some level of read access is needed. However, the vulnerability description explicitly states exploitation is possible via public access on a publicly viewable document, which implies PR:N is the accurate worst-case metric - a discrepancy worth noting. Real-world risk is elevated for organizations using Grist access rules as a primary mechanism to conceal sensitive schema design (e.g., hidden pricing tables, internal column names, restricted data categories), since the bypass completely undermines that control for any viewer. Impact is bounded to schema metadata only - actual cell data is not exposed - which keeps overall severity in the medium range. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV and no POC has been identified, suggesting opportunistic exploitation is not currently occurring. The primary risk is targeted reconnaissance by a low-privileged or anonymous user seeking to map hidden document structure prior to further attacks or data exfiltration attempts.

An anonymous user browses to a publicly shared Grist document and, by enumerating or guessing section IDs from the document URL, sends a crafted GET /forms request referencing a non-form section. The server returns the full table and column metadata for that section - including names and types of columns the document owner's access rules intended to hide - without requiring authentication or triggering any access rule evaluation. No public exploit code has been identified, but the attack requires only standard HTTP tooling and knowledge of the section ID format observable from normal document interaction.