CVE-2026-119759: TrailBase 0.28.2 < 0.35.10 IDOR via Record API File Column
TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated attackers to manipulate the object-store id metadata within std.FileUpload columns without ownership validation during insert and update operations. Attackers can reference another user's or table's file id in a record they own to read the victim's file bytes through their own record, or trigger permanent deletion of the victim's file by deleting or nulling their own record, while also using a $like filter on the file column to brute-force recover stripped ids character by character.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TrailBaseto a version that resolves this vulnerability.Fixed in 0.35.10
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker with low-level privileges can exploit it remotely. The attacker needs the ability to insert or update records containing std.FileUpload columns.
What can an attacker do with another user's file ID?
They can place another user's or table's object-store file ID into a record they own, then read that file through their own record. Deleting or nulling the attacker-controlled record can also permanently delete the referenced victim file.
Can file IDs be discovered rather than already known?
Yes. The Record API's $like filter on a file column can be used to brute-force stripped file IDs character by character.
Which versions are affected?
TrailBase versions from 0.28.2 before 0.35.10 are affected. Version 0.35.10 is the stated fixed release.