{"id":"CVE-2026-123623","kind":"vulnerability","aliases":["CVE-2026-123623"],"related":[],"title":"Grida: unauthenticated attackers can read other organizations' form attachments","description":"Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows unauthenticated attackers to read other organizations' form response files. Attackers can use form and field IDs exposed in public form payloads with a chosen path parameter to obtain service-role signed URLs for attachments and connected Supabase bucket objects.","summary":"Grida's Forms file-preview API routes do not check authorization, so anyone can request signed URLs for form response files. An unauthenticated attacker can read attachments and Supabase bucket objects belonging to other organizations, using form and field IDs visible in public form payloads.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grida","package","self-hosted","supabase"],"not_affected_if":["no-file-attachments","no-forms-feature"],"how_to_check":"- Check whether your Grida editor build is 0.0.24 or older, or does not include commit 05f5a54 (git merge-base --is-ancestor 05f5a54c31a6662942a42b50e34a329ab3642fe1 HEAD).\n- Look for the routes editor/app/(api)/private/editor/[form_id]/fields/[field_id]/file/preview/src and .../preview/public-url; if they use service_role.forms with no ownership check, you are exposed.\n- Also check whether form fields store files in the shared grida-forms-response bucket or in a connected external Supabase project.","fix":"No fixed release version published that I could find. The maintainers fixed it in commit 05f5a54 (PR #1108, 'authorize response file previews as the caller'). Self-hosters: deploy a build that includes that commit and redeploy the editor. The releases page lists no version number for it.","status":"open","published_at":"2026-11-06T16:17:54+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","triaged_at":"2026-11-06T16:44:35+00:00","updated_at":"2026-11-06T16:45:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T16:44:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Grida: unauthenticated attackers can read other organizations' form attachments","impact":"medium","summary":"Grida's Forms file-preview API routes do not check authorization, so anyone can request signed URLs for form response files. An unauthenticated attacker can read attachments and Supabase bucket objects belonging to other organizations, using form and field IDs visible in public form payloads.","audience":"businesses","category":"package","nicknames":[],"who_cares":["grida","supabase","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attackers read other organizations' private form attachments without logging in.","analyst_note":"Find the fixed version and the Patch commit on github.com linked from the NVD entry; the sources here give no fixed version.","how_to_check":"- Check the installed Grida version against the affected range through 0.0.24.\n- Look for the Forms file-preview API routes in your deployment and whether form attachments are stored in connected Supabase buckets.\n- unknown for any further exposure check; the sources do not give one.","plain_action":"","needs_analyst":true,"not_affected_if":["no-forms-feature","no-file-attachments"],"who_is_affected":"Teams that self-host or run Grida versions through 0.0.24 with the Forms feature and file attachments stored in Supabase buckets are exposed. Deployments without the Forms file-preview routes or without stored form attachments have less to lose. The sources do not say whether managed Grida hosting is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4279,"output_tokens":570,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the Patch commit on github.com linked from the NVD entry; the sources here give no fixed version.","search":"'-123623':12A,15A '-2026':11A,14A '0.0.24':70C 'allow':85C 'anyon':35B 'api':28B,82C 'attach':9A,49B,120C 'attack':3A,46B,87C,95C 'author':33B,74C 'belong':54B 'bucket':52B,124C 'check':32B 'chosen':109C 'connect':122C 'contain':71C 'cve':10A,13A 'expos':102C 'field':61B,100C 'file':26B,43B,80C,94C 'file-preview':25B,79C 'form':8A,24B,41B,59B,66B,78C,92C,98C,105C 'grida':1A,16B,22B,68C 'host':20B 'id':62B,101C 'miss':73C 'object':53B,125C 'obtain':113C 'organ':7A,57B,91C 'packag':17B 'paramet':111C 'path':110C 'payload':67B,106C 'preview':27B,81C 'public':65B,104C 'read':5A,48B,89C 'request':37B 'respons':42B,93C 'role':116C 'rout':29B,83C 'self':19B 'self-host':18B 'servic':115C 'service-rol':114C 'sign':38B,117C 'supabas':21B,51B,123C 'unauthent':2A,45B,86C 'url':39B,118C 'use':58B,97C 'visibl':63B 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Grida editors at 0.0.24 or older (or built before commit 05f5a54) that use Forms with file uploads. Anyone who can see a published form can get its form and field IDs and request signed URLs for response files; fields using a connected external Supabase project also allow reading arbitrary paths in that project's bucket. The reporter did a source review only; whether Grida's hosted service was affected is not stated. Skip it if you do not use Forms or file-upload fields.","tier":"B","verified":{"fix":{"at":"2026-11-06T16:45:52Z","by":"analyst","doc":"https://github.com/gridaco/grida/commit/05f5a54c31a6662942a42b50e34a329ab3642fe1","run_id":1912}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["grida","high","package","selfhosted","supabase"],"campaign_type":null,"search_a":"'-123623':12A,15A '-2026':11A,14A 'attach':9A 'attack':3A 'cve':10A,13A 'form':8A 'grida':1A 'organ':7A 'read':5A 'unauthent':2A","search_b":"'anyon':35B 'api':28B 'attach':49B 'attack':46B 'author':33B 'belong':54B 'bucket':52B 'check':32B 'field':61B 'file':26B,43B 'file-preview':25B 'form':24B,41B,59B,66B 'grida':16B,22B 'host':20B 'id':62B 'object':53B 'organ':57B 'packag':17B 'payload':67B 'preview':27B 'public':65B 'read':48B 'request':37B 'respons':42B 'rout':29B 'self':19B 'self-host':18B 'sign':38B 'supabas':21B,51B 'unauthent':45B 'url':39B 'use':58B 'visibl':63B","search_c":"'0.0.24':70C 'allow':85C 'api':82C 'attach':120C 'attack':87C,95C 'author':74C 'bucket':124C 'chosen':109C 'connect':122C 'contain':71C 'expos':102C 'field':100C 'file':80C,94C 'file-preview':79C 'form':78C,92C,98C,105C 'grida':68C 'id':101C 'miss':73C 'object':125C 'obtain':113C 'organ':91C 'paramet':111C 'path':110C 'payload':106C 'preview':81C 'public':104C 'read':89C 'respons':93C 'role':116C 'rout':83C 'servic':115C 'service-rol':114C 'sign':117C 'supabas':123C 'unauthent':86C 'url':118C 'use':97C 'vulner':75C","first_public_at":"2026-11-06T16:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123623","severity":null,"published_at":"2026-11-06T16:17:54+00:00","modified_at":"2026-11-06T16:17:54+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","fetched_at":"2026-11-06T16:42:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123623:1912","url":"https://github.com/gridaco/grida/issues/1107","severity":null,"published_at":"2026-11-06T16:45:52+00:00","modified_at":"2026-11-06T16:45:52+00:00","first_seen_at":"2026-11-06T16:45:52+00:00","fetched_at":"2026-11-06T16:45:52+00:00","note":"Read maintainer issue #1107 and fix commit 05f5a54 (PR #1108, 2026-11-06). No release version containing the fix found on the releases page; fix is a commit on main. Reporter did static review only; no PoC, no exploitation seen.","cites":["https://github.com/gridaco/grida/issues/1107"]}],"documents":[{"id":87933,"url":"https://github.com/gridaco/grida/commit/05f5a54c31a6662942a42b50e34a329ab3642fe1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87934,"url":"https://www.vulncheck.com/advisories/grida-through-0.0.24-missing-authorization-in-forms-file-preview-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":87997,"url":"https://github.com/gridaco/grida/issues/1107","title":"Forms file-preview routes use service-role client with no ownership check (#1107)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}