HIGH 8.2 NVD
CVE-2026-123623
Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows unauthenticated attackers to read other org
Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows unauthenticated attackers to read other organizations' form response files. Attackers can use form and field IDs exposed in public form payloads with a chosen path parameter to obtain service-role signed URLs for attachments and connected Supabase bucket objects.
References
- https://github.com/gridaco/grida
- https://github.com/gridaco/grida/blob/v0.0.24/editor/app/(api)/private/editor/%5Bform_id%5
- https://github.com/gridaco/grida/commit/05f5a54c31a6662942a42b50e34a329ab3642fe1
- https://github.com/gridaco/grida/issues/1107
- https://github.com/gridaco/grida/pull/1108
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-11-06 via NVD.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.