CVE-2026-16753

Lowcoder up to and including version 2.4.10 has an incorrect-authorization flaw in its library-query execution endpoint. An authenticated administrator or developer in one organization can send a crafted request that names another organization's library-query identifier and execute that query. Successful use can return data the attacker is not authorized to access, which is a cross-tenant data-exfiltration risk on multi-organization deployments. Anyone running an affected Lowcoder instance that hosts more than one organization is affected. There is no known public proof of concept and no indication of exploitation in the wild.

What to do: Upgrade Lowcoder to a release newer than 2.4.10 as soon as the vendor publishes a fix, and treat every organization that shares an instance as potentially exposed until then. Limit administrator and developer roles, and review library-query execution logs for requests that target another organization's query identifiers.