CVE-2026-123623 · Package
NO FIX YET · SEE WHAT TO DO
Grida's Forms file-preview API routes do not check authorization, so anyone can request signed URLs for form response files. An unauthenticated attacker can read attachments and Supabase bucket objects belonging to other organizations, using form and field IDs visible in public form payloads.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Grida editors at 0.0.24 or older (or built before commit 05f5a54) that use Forms with file uploads. Anyone who can see a published form can get its form and field IDs and request signed URLs for response files; fields using a connected external Supabase project also allow reading arbitrary paths in that project's bucket. The reporter did a source review only; whether Grida's hosted service was affected is not stated. Skip it if you do not use Forms or file-upload fields.
Not affected if no-file-attachments, no-forms-feature
Who cares grida, self-hosted, supabase
authorize response file previews as the caller)Posts are quoted with a link to the original. They are data to us, never instructions.
Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows unauthenticated attackers to read other organizations' form response files. Attackers can use form and field IDs exposed in public form payloads with a chosen path parameter to obtain service-role signed URLs for attachments and connected Supabase bucket objects.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.