CVE-2026-55664

Received Received - Intake

Grist Spreadsheet Software Metadata Exposure via Unauthorized Access

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actually a form. A user with only partial read access, including public access on a publicly viewable document, could request the metadata of any widget and reveal table and column structure that access rules would otherwise hide, even in documents that contain no forms. This issue is fixed in version 1.7.15.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-55664

Affected Vendors & Products

Vendor	Product	Version / Range
grist	grist	1.7.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Grist spreadsheet software versions prior to 1.7.15. The GET /forms endpoint improperly handled access controls by reading table and column metadata without enforcing the document's access rules. Additionally, it did not verify that the requested section was actually a form. As a result, a user with only partial read access, including public access to a publicly viewable document, could request metadata of any widget and reveal table and column structures that should have been hidden by access rules, even if the document contained no forms.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive metadata about tables and columns within Grist documents. Users with limited or public access could gain insight into the structure of data they are not permitted to see, potentially exposing confidential or sensitive information indirectly by revealing schema details that access controls were supposed to protect.

Mitigation Strategies

To mitigate this vulnerability, upgrade Grist to version 1.7.15 or later, where the issue has been fixed.

Compliance Impact

This vulnerability allows users with partial read access to retrieve metadata about tables and columns that should be restricted by access rules. Such unauthorized disclosure of metadata could potentially lead to exposure of sensitive information structures.

While the CVE description does not explicitly mention compliance with standards like GDPR or HIPAA, unauthorized access to metadata could be considered a data privacy issue under these regulations, as it may reveal information that should be protected.

Therefore, this vulnerability could negatively impact compliance with data protection regulations by allowing unintended information disclosure.

Hi! I’m here to help you understand CVE-2026-55664. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70