CVE-2026-125748

MEDIUM 4.3

Parabol before 15.21.2 Missing Authorization via addReactjiToReactable Mutation

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactableId of another tenant's reflection, comment, or sequential team prompt response to add or remove their reactions.

CWE	CWE-639
Vendor	parabol
Product	parabol
Published	Nov 10, 2026
Last Updated	Nov 10, 2026

Stay Ahead of the Next One

Get instant alerts for parabol parabol

Be the first to know when new medium vulnerabilities affecting parabol parabol are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

Parabol / Parabol

0 < 15.21.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ParabolInc/parabol/issues/13727 github.com: https://github.com/ParabolInc/parabol/commit/1f063b2f2768ad3a6138156ddce9d938f58e8005 github.com: https://github.com/ParabolInc/parabol/releases/tag/v15.21.2 github.com: https://github.com/ParabolInc/parabol/blob/v15.21.1/packages/server/graphql/public/mutations/addReactjiToReactable.ts#L36-L99 hackmd.io: https://hackmd.io/@hieuPenguinnn/parabol-addreactjitoreactable-cross-meeting-idor vulncheck.com: https://www.vulncheck.com/advisories/parabol-before-15.21.2-missing-authorization-via-addreactjitoreactable-mutation

Credits

hieuPenguinnn