CVE-2026-16753

Deferred Deferred - Pending Action

Incorrect Authorization in Lowcoder Library-Query Execution

Publication date: 2026-10-13

Last updated on: 2026-10-20

Assigner: CERT/CC

Description

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-20

Generated

2026-11-08

AI Q&A

2026-10-14

EPSS Evaluated

2026-11-07

NVD

CVE-2026-16753

EUVD

EUVD-2026-100524

Affected Vendors & Products

Vendor	Product	Version / Range
Lowcoder	Lowcoder	2.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect authorization in Lowcoder's library-query execution endpoint. An authenticated administrator or developer in one organization can execute a library query belonging to another organization by sending a crafted request with the victim's library-query identifier.

Detection Guidance

To detect this vulnerability, inspect network traffic for unauthorized access to the library-query execution endpoint in Lowcoder versions up to 2.4.10. Check logs for requests containing library-query identifiers from different organizations. Monitor for unusual administrator or developer actions across organizations.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive data or operations across different organizations within the same Lowcoder instance. This may lead to data breaches, unauthorized modifications, or misuse of organizational resources.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to personal or sensitive data. Organizations using Lowcoder may face legal penalties, reputational damage, and loss of trust due to compromised data integrity and confidentiality.

Mitigation Strategies

Immediately update Lowcoder to a version beyond 2.4.10 to address the authorization flaw. Review and restrict access controls for library-query endpoints to ensure proper isolation between organizations. Monitor logs for unauthorized access attempts to library queries.

Hi! I’m here to help you understand CVE-2026-16753. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...