{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/382143#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nLowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an `admin` or `dev` role can access private library-query data from other organizations within a multi-tenant Lowcoder instance.\r\n\r\n### Description\r\n***CVE-2026-16753*** Lowcoder is an open-source low-code platform that allows individuals with minimal coding experience to build web applications through a visual drag-and-drop interface. Each Lowcoder project contains a centralized Query Library which stores the workspace’s data queries and sources for quick reuse; however, the `LibraryQuery` API service layer lacks organization-scope checks at two endpoints: metadata retrieval and query execution.\r\n\r\nWhile the application features a role-based access mechanism (requires `admin` or `dev`), it only checks the role’s validity against the user’s own organization. The vulnerable endpoints do not validate whether the requested resource belongs to the requester's organization.\r\n\r\n### Impact\r\nAny authenticated attacker with an `admin` or `dev` role in any organization on a multi-tenant Lowcoder instance can access other tenants’ Query Libraries. Note that these roles are granted by default for any self-signup account when `LOWCODER_EMAIL_SIGNUP_ENABLED` and `LOWCODER_CREATE_WORKSPACE_ON_SIGNUP` are `TRUE`. This allows an attacker to do the following: \r\n\r\n* Read the full Domain Specific Language (DSL) of any other organization’s library queries, including complete query configuration and each referenced `datasourceId`.\r\n\r\n* Execute any library query available on the instance, receiving response data directly from the affected organization’s backend data source.\r\n\r\nPotential impacts include cross-tenant data exposure, modification, or destruction, as well as cost abuse via querying paid data sources using another tenant’s finances. By bypassing organization-level authorization, Lowcoder instances effectively function as shared environments for attackers, violating data isolation between organizations.\r\n\r\nThis vulnerability was confirmed against Lowcoder version 2.4.10. \r\n\r\n### Solution\r\nUnfortunately, Lowcoder could not be reached to coordinate this vulnerability. \r\n\r\n#### Mitigations\r\nLowcoder administrators should restrict access to the affected Query Library API endpoints until an official security update is available. Administrators can reduce exposure by limiting application access to trusted users and reviewing `admin` and `dev` role assignments. Organizations operating multi-tenant Lowcoder deployments should consider isolating tenants into separate instances to prevent cross-organization data access. Where source-code modifications are possible, administrators should implement organization-level authorization checks for Query Library metadata retrieval and query execution.\r\n\r\n### Acknowledgements\r\nThanks to Louis Sanchez, member of Voke Cyber, for reporting this vulnerability. This document was written by Alex Lewis.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/382143"},{"url":"https://github.com/lowcoder-org/lowcoder","summary":"https://github.com/lowcoder-org/lowcoder"}],"title":"Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration","tracking":{"current_release_date":"2026-10-13T19:21:56+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.50"}},"id":"VU#382143","initial_release_date":"2026-10-13 19:21:56.233908+00:00","revision_history":[{"date":"2026-10-13T19:21:56+00:00","number":"1.20261013192156.1","summary":"Released on 2026-10-13T19:21:56+00:00"}],"status":"final","version":"1.20261013192156.1"}},"vulnerabilities":[{"title":"Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.","notes":[{"category":"summary","text":"Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier."}],"cve":"CVE-2026-16753","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#382143"}]}],"product_tree":{"branches":[]}}