CVE-2026-16753: Lowcoder Lowcoder vulnerability

Q: Does exploitation require an existing Lowcoder account with elevated privileges?

Yes. The issue can be exploited by an authenticated administrator or developer account in any organization.

Q: Is the impact limited to resources within the attacker's own organization?

No. A crafted request using another organization's library-query identifier can execute that other organization's library query.

Q: Which releases should be considered affected?

Lowcoder versions up to and including 2.4.10 are affected.

Published Oct 13, 2026

Updated

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.

Affected Software

1 affected component

Lowcoder Lowcoder<=2.4.10

Event History

Oct 13, 2026

CVE Published

via MITRE·07:21 PM

Data Sourced

via MITRE·07:21 PM

DescriptionWeakness

Frequently Asked Questions

Does exploitation require an existing Lowcoder account with elevated privileges?

Yes. The issue can be exploited by an authenticated administrator or developer account in any organization.

Is the impact limited to resources within the attacker's own organization?

No. A crafted request using another organization's library-query identifier can execute that other organization's library query.

Which releases should be considered affected?

Lowcoder versions up to and including 2.4.10 are affected.