Missing Authorization Issue in Grida Product Allows Unauthenticated Data Exposure

CVE-2026-123623

What is CVE-2026-123623?

Grida versions up to 0.0.24 are vulnerable due to a missing authorization flaw in the Forms file-preview API routes. This vulnerability permits unauthenticated attackers to access form response files belonging to other organizations. By exploiting exposed form and field IDs in publicly available form payloads, attackers can manipulate a chosen path parameter. This allows them to obtain service-role signed URLs for attachments and connected objects in Supabase buckets, potentially leading to sensitive data breaches.

References