CVE-2026-123623

MEDIUM 5.9

Grida through 0.0.24 Missing Authorization in Forms File-Preview API

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows unauthenticated attackers to read other organizations' form response files. Attackers can use form and field IDs exposed in public form payloads with a chosen path parameter to obtain service-role signed URLs for attachments and connected Supabase bucket objects.

CWE	CWE-862
Vendor	gridaco
Product	grida
Published	Nov 6, 2026

Stay Ahead of the Next One

Get instant alerts for gridaco grida

Be the first to know when new medium vulnerabilities affecting gridaco grida are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

gridaco / grida

0 ≤ 0.0.24

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/gridaco/grida/issues/1107 github.com: https://github.com/gridaco/grida github.com: https://github.com/gridaco/grida/pull/1108 github.com: https://github.com/gridaco/grida/commit/05f5a54c31a6662942a42b50e34a329ab3642fe1 github.com: https://github.com/gridaco/grida/blob/v0.0.24/editor/app/(api)/private/editor/%5Bform_id%5D/fields/%5Bfield_id%5D/file/preview/src/route.ts#L27-L101 hackmd.io: https://hackmd.io/@hieund/grida-forms-file-preview-missing-authz vulncheck.com: https://www.vulncheck.com/advisories/grida-through-0.0.24-missing-authorization-in-forms-file-preview-api

Credits

HieuPenguinnn Asish Kumar