CVE-2026-125748 · Other
NO FIX YET · SEE WHAT TO DO
Parabol before 15.21.2 has a missing authorization check in the addReactjiToReactable GraphQL mutation. A logged-in user can pair their own meetingId with another organization's reactable ID and add or remove reactions on that content.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted or managed Parabol deployments below 15.21.2 with multiple organizations on the same instance are exposed, since the flaw crosses tenant boundaries. Single-organization installs have less cross-tenant exposure. The sources do not say whether managed Parabol hosting has already been patched.
Not affected if single-organization, version-15.21.2-or-later
Who cares graphql, multi-tenant, parabol, self-hosted
15.21.2 are affected.15.21.2 or laterParabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactableId of another tenant's reflection, comment, or sequential team prompt response to add or remove their reactions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.