{"id":"CVE-2026-82986","kind":"vulnerability","aliases":["CVE-2026-82986"],"related":[],"title":"Group members can create share links despite administrator restriction","description":"The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.","summary":"A user in a group can bypass the administrator's group restriction on link sharing and create share links for a table they should not be allowed to share. An attacker with a normal account gets to expose table data through links the administrator meant to block.","severity":"medium","cvss":4.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["link-sharing","other","table-permissions"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T17:17:03+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","triaged_at":"2026-10-27T17:34:55+00:00","updated_at":"2026-10-27T17:34:55+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T17:34:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Group members can create share links despite administrator restriction","impact":"medium","summary":"A user in a group can bypass the administrator's group restriction on link sharing and create share links for a table they should not be allowed to share. An attacker with a normal account gets to expose table data through links the administrator meant to block.","category":"other","nicknames":[],"who_cares":["link-sharing","table-permissions"],"confidence":0.4,"needs_auth":"yes","worst_case":"Authenticated user exposes table data via unauthorized share links","analyst_note":"Identify the affected product and fixed version from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-82986; the sources do not name the product.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000494,"input_tokens":3257,"output_tokens":337,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-82986':12A,15A 'account':57B 'administr':8A,31B,66B,83C 'allow':49B 'attack':53B 'block':69B 'bypass':29B,76C 'creat':4A,39B,87C 'cve':10A,13A 'data':62B 'despit':7A 'even':93C 'expos':60B 'get':58B 'group':1A,27B,33B,74C,78C 'link':6A,17B,36B,41B,64B,85C,89C 'link-shar':16B 'meant':67B 'member':2A 'normal':56B 'permiss':22B,100C 'restrict':9A,34B,79C 'set':80C 'share':5A,18B,37B,40B,51B,86C,88C 'shouldn':96C 'tabl':21B,44B,61B,92C 'table-permiss':20B 'though':94C 'user':24B,71C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82986","severity":null,"published_at":"2026-10-27T17:17:03+00:00","modified_at":"2026-10-27T17:17:03+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","fetched_at":"2026-10-27T17:32:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}