Incorrect Authorization in Lowcoder Library-Query Execution

Executive Summary

This vulnerability involves incorrect authorization in Lowcoder's library-query execution endpoint. An authenticated administrator or developer in one organization can execute a library query belonging to another organization by sending a crafted request with the victim's library-query identifier.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for unauthorized access to the library-query execution endpoint in Lowcoder versions up to 2.4.10. Check logs for requests containing library-query identifiers from different organizations. Monitor for unusual administrator or developer actions across organizations.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive data or operations across different organizations within the same Lowcoder instance. This may lead to data breaches, unauthorized modifications, or misuse of organizational resources.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to personal or sensitive data. Organizations using Lowcoder may face legal penalties, reputational damage, and loss of trust due to compromised data integrity and confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Lowcoder to a version beyond 2.4.10 to address the authorization flaw. Review and restrict access controls for library-query endpoints to ensure proper isolation between organizations. Monitor logs for unauthorized access attempts to library queries.

Useful 0 Not Useful 0