CVE-2026-111666: Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API
Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enablespaceglobal objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with access to the affected Steedos Platform reports API can exploit it. No user interaction is required.
What information can be exposed?
An attacker can read report definitions belonging to other tenants, including report names, descriptions, and object and field API names.
What request is used to retrieve cross-tenant report data?
The disclosed attack path is a GET request to /api/v1/reports. The issue occurs because space filtering is skipped for the globally enabled reports object during find and findOne operations.
Is this limited to a particular Steedos Platform release range?
The affected range stated is Steedos Platform through 3.0.15-beta.51. The provided information does not identify a fixed version.