CVE-2026-82986: Medium severity vulnerability
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must already be a user in the affected group, so this is not exploitable by an unauthenticated external party. Exploitation also requires user interaction.
What restriction can be bypassed?
A group member can create share links for a table despite an administrator-configured group restriction intended to prevent that action. The issue affects the enforcement of link-sharing permissions.
What is the practical impact?
Unauthorized share links may expose table contents to recipients chosen by the group member and may allow unintended changes through those links. The reported impact is limited confidentiality and integrity loss, with no availability impact.