VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration
CERT/CC says Lowcoder 2.4.10 lets admins or developers read and run other tenants' library queries.
CERT/CC published VU#382143 for CVE-2026-16753 in Lowcoder 2.4.10. The Query Library API validates an admin or developer role only against the caller's own organization and does not check that the requested query belongs to that organization. An authenticated admin or developer on a multi-tenant instance can read another tenant's query DSL, including datasource IDs, and execute those queries against the victim's data sources. Lowcoder could not be reached; CERT advises restricting the endpoints, reviewing privileged roles, or isolating tenants.
- CVE-2026-16753 affects Lowcoder 2.4.10 Query Library API.
- Metadata and execution endpoints lack organization-scope checks.
- Default self-signup can grant admin or dev roles.
- Attackers may expose, modify, or destroy other tenants' data.
- Lowcoder was unreachable and no official patch is listed.
- CVEs
- CVE-2026-16753
- Vendors
- Lowcoder
- Products
- Lowcoder
- Organizations
- CERT/CCVoke Cyber
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-16753 | Cross-tenant auth bypass in Lowcoder library queries | 8.8 | — |
From the original article
2 min read at kb.cert.orgOverview Lowcoder, version 2. 4. 10, contains an authorization bypass vulnerability in its Query Library feature’s API.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.