---
id: "CVE-2026-123623"
page: "https://infrastack.ai/live/CVE-2026-123623"
kind: "vulnerability"
aliases: ["CVE-2026-123623"]
title: "Grida: unauthenticated attackers can read other organizations' form attachments"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["grida", "package", "self-hosted", "supabase"]
not_affected_if: ["no-file-attachments", "no-forms-feature"]
published_at: "2026-11-06T16:17:54+00:00"
first_seen_at: "2026-11-06T16:42:41+00:00"
updated_at: "2026-11-06T16:45:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123623", "first_seen_at": "2026-11-06T16:42:41+00:00"}, {"source": "analyst", "url": "https://github.com/gridaco/grida/issues/1107", "first_seen_at": "2026-11-06T16:45:52+00:00", "cites": ["https://github.com/gridaco/grida/issues/1107"]}]
exploit_sources: []
---

# Grida: unauthenticated attackers can read other organizations' form attachments

Link for people: https://infrastack.ai/live/CVE-2026-123623 (this .md is for agents)

Grida's Forms file-preview API routes do not check authorization, so anyone can request signed URLs for form response files. An unauthenticated attacker can read attachments and Supabase bucket objects belonging to other organizations, using form and field IDs visible in public form payloads.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your Grida editor build is 0.0.24 or older, or does not include commit 05f5a54 (git merge-base --is-ancestor 05f5a54c31a6662942a42b50e34a329ab3642fe1 HEAD).
- Look for the routes editor/app/(api)/private/editor/[form_id]/fields/[field_id]/file/preview/src and .../preview/public-url; if they use service_role.forms with no ownership check, you are exposed.
- Also check whether form fields store files in the shared grida-forms-response bucket or in a connected external Supabase project.

## Fix

No fixed release version published that I could find. The maintainers fixed it in commit 05f5a54 (PR #1108, 'authorize response file previews as the caller'). Self-hosters: deploy a build that includes that commit and redeploy the editor. The releases page lists no version number for it.

## Timeline

- 2026-11-06T16:42:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123623
- 2026-11-06T16:45:52+00:00 analyst https://github.com/gridaco/grida/issues/1107 — Read maintainer issue #1107 and fix commit 05f5a54 (PR #1108, 2026-11-06). No release version containing the fix found on the releases page; fix is a commit on main. Reporter did static review only; no PoC, no exploitation seen.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/grida-through-0.0.24-missing-authorization-in-forms-file-preview-api
- [describes] Forms file-preview routes use service-role client with no ownership check (#1107) https://github.com/gridaco/grida/issues/1107
- [fix] Patch: github.com https://github.com/gridaco/grida/commit/05f5a54c31a6662942a42b50e34a329ab3642fe1

## From the sources

Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows unauthenticated attackers to read other organizations' form response files. Attackers can use form and field IDs exposed in public form payloads with a chosen path parameter to obtain service-role signed URLs for attachments and connected Supabase bucket objects.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_