Grist CVE-2026-55665

Exploitation requires victim interaction - the target must click a poisoned link (an account button on /welcome/select-account whose next parameter was attacker-supplied, or a document-tour button whose GristDocTour Link_URL contains a javascript: URI). The document-tour vector additionally requires the attacker to already hold editor rights on a document shared with the victim, so it is bounded to shared/multi-user deployments; the select-account vector needs no authentication but does need the attacker to deliver the crafted URL to the victim. The payload only gains privileges the victim already has, so escalation impact scales with the victim's role (an editor victim yields editor-scope actions, an owner victim yields full owner control). Limiting factors: mandatory single click (UI:A), the editor-access prerequisite for the persistent vector, and applicability only to Grist versions before 1.7.15.

The vendor CVSS 4.0 base score is 8.5 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N) - network-reachable, low complexity, but requiring user interaction (a click). That UI:A caveat is the key limiter: exploitation is not fully automatable and depends on social engineering or a victim opening a booby-trapped shared document. Note a nuance the single vector does not capture: the tour-based vector actually requires editor privileges on a shared document (PR:L in practice), while the select-account vector is unauthenticated (PR:N); the published PR:N reflects the weakest precondition. There is no EPSS score, no SSVC decision, and no KEV/POC data supplied, so real-world exploitation pressure is currently unquantified. This is a genuine privilege-escalation issue in multi-user Grist deployments (editor→owner), so for organizations sharing documents it is a real priority to patch, but the click requirement and the niche footprint make mass, automated exploitation unlikely.

An attacker with editor access to a shared Grist document adds a document tour and sets the GristDocTour Link_URL to a javascript: payload; when a colleague opens the document and clicks the tour link, the script runs in their authenticated session and calls Grist APIs to grant the attacker owner-level access. Alternatively, the attacker sends a victim a crafted /welcome/select-account URL whose next parameter carries a javascript: payload, executing when the victim clicks an account button. No public exploit code has been identified, but the flaw is low-complexity to trigger once the victim interacts.