Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.
Fix
Vendor advisories in the News 1
- VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration CERT/CC Vulnerability Notes · 2026-10-13
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 4
- CwesCWE-639, CWE-863NVD modified 2026-10-20 17:17
- CVSS8.8 (v3.1, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)NVD modified 2026-10-20 17:17
- StatusReceived → DeferredNVD modified 2026-10-16 20:04
- First seenunscoredNVD modified 2026-10-13 21:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.