CVE-2026-123623: Grida through 0.0.24 Missing Authorization in Forms File-Preview API

Published Nov 6, 2026

Updated

Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows unauthenticated attackers to read other organizations' form response files. Attackers can use form and field IDs exposed in public form payloads with a chosen path parameter to obtain service-role signed URLs for attachments and connected Supabase bucket objects.

Event History

Nov 6, 2026

CVE Published

via MITRE·03:16 PM

Data Sourced

via MITRE·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Organizations using Grida through 0.0.24 with Forms attachments or connected Supabase bucket objects may be exposed. The affected file-preview API routes can return access to files belonging to other organizations.

What does an attacker need to exploit it?

No authentication is required. An attacker needs form and field IDs exposed in public form payloads and can use those IDs with a chosen path parameter to request service-role signed URLs.

What is the impact of a successful request?

A successful exploit can allow an unauthenticated attacker to read form response attachments and connected Supabase bucket objects from other organizations. The API generates service-role signed URLs for the targeted files.

CVE-2026-123623: Grida through 0.0.24 Missing Authorization in Forms File-Preview API

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of a successful request?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of a successful request?