Data Exposure in Activepieces AI Workflow Automation Platform

CVE-2026-53536

What is CVE-2026-53536?

Activepieces, an open-source AI workflow automation platform, was found to have a vulnerability in its /v1/step-files/signed download endpoint prior to version 0.83.0. This vulnerability stemmed from inadequate validation of JSON Web Tokens (JWTs) against token audiences and a missing null-check on decoded fileIds. As a result, any user possessing a valid Activepieces JWT could inadvertently access step-file attachments belonging to other tenants within the same instance. The data response for these files varied as it depended on the PostgreSQL database contents at any given time. Although this resulted in read-only access, it highlighted the need for improved security measures to ensure tenants' files remain isolated. This vulnerability has been addressed in version 0.83.0.

References