VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration
Cybersecurity Open Source Classified by Officially
Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. …
This is an extract. The publication continues at the source.
Read the original at the source: https://kb.cert.org/vuls/id/382143
Officially imported this from CERT Coordination Center’s own source and shows an extract. If you work there, claiming the profile and verifying the domain lets you choose to show the full text here.
Provenance
- Organization
- CERT Coordination Center — imported from official source
- Official source
- https://www.kb.cert.org/vuls/atomfeed/ ATOM
- Imported
- October 13, 2026 20:00
- Versions
- 1 recorded
- Identity
-
https://kb.cert.org/vuls/id/382143