CVE-2026-125748: Parabol before 15.21.2 Missing Authorization via addReactjiToReactable Mutation

Published Nov 10, 2026

Updated

Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactableId of another tenant's reflection, comment, or sequential team prompt response to add or remove their reactions.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Parabol to a version that resolves this vulnerability.
Fixed in 15.21.2

Event History

Nov 10, 2026

CVE Published

via MITRE·03:22 PM

Data Sourced

via MITRE·03:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated and able to invoke the addReactjiToReactable GraphQL mutation. No user interaction is required.

What content can be affected across organizations?

The issue can be used to add or remove the attacker's reactions on another tenant's reflections, comments, or sequential team prompt responses by pairing the attacker's own meetingId with a target reactableId.

Which versions are affected?

Parabol versions before 15.21.2 are affected. Upgrading to 15.21.2 or later addresses the issue.

CVE-2026-125748: Parabol before 15.21.2 Missing Authorization via addReactjiToReactable Mutation

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What content can be affected across organizations?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What content can be affected across organizations?

Which versions are affected?