CVE-2026-55664

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actually a form. A user with only partial read access, including public access on a publicly viewable document, could request the metadata of any widget and reveal table and column structure that access rules would otherwise hide, even in documents that contain no forms. This issue is fixed in version 1.7.15.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/gristlabs/grist-core/commit/14694156fe99c438c5f7a452ad367e933bb194db
https://github.com/gristlabs/grist-core/releases/tag/v1.7.15
https://github.com/gristlabs/grist-core/security/advisories/GHSA-w2hc-w6cg-xvh9

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Grist es un software de hoja de cálculo que utiliza Python como su lenguaje de fórmulas. Antes de 1.7.15, el endpoint GET /forms leía los metadatos de tablas y columnas sin aplicar las reglas de acceso del documento y no verificaba que la sección solicitada fuera realmente un formulario. Un usuario con solo acceso de lectura parcial, incluyendo acceso público en un documento visible públicamente, podía solicitar los metadatos de cualquier widget y revelar la estructura de tablas y columnas que las reglas de acceso ocultarían de otro modo, incluso en documentos que no contienen formularios. Este problema está solucionado en la versión 1.7.15.

Information

Published : 2026-07-10 21:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-55664

Mitre link : CVE-2026-55664

CVE.ORG link : CVE-2026-55664

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-285

Improper Authorization

{"id": "CVE-2026-55664", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55664", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:34:28.495573Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gristlabs", "product": "grist-core", "versions": [{"status": "affected", "version": "< 1.7.15"}]}]}], "published": "2026-07-10T21:16:56.723", "references": [{"url": "https://github.com/gristlabs/grist-core/commit/14694156fe99c438c5f7a452ad367e933bb194db", "source": "security-advisories@github.com"}, {"url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15", "source": "security-advisories@github.com"}, {"url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-w2hc-w6cg-xvh9", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actually a form. A user with only partial read access, including public access on a publicly viewable document, could request the metadata of any widget and reveal table and column structure that access rules would otherwise hide, even in documents that contain no forms. This issue is fixed in version 1.7.15."}, {"lang": "es", "value": "Grist es un software de hoja de c\u00e1lculo que utiliza Python como su lenguaje de f\u00f3rmulas. Antes de 1.7.15, el endpoint GET /forms le\u00eda los metadatos de tablas y columnas sin aplicar las reglas de acceso del documento y no verificaba que la secci\u00f3n solicitada fuera realmente un formulario. Un usuario con solo acceso de lectura parcial, incluyendo acceso p\u00fablico en un documento visible p\u00fablicamente, pod\u00eda solicitar los metadatos de cualquier widget y revelar la estructura de tablas y columnas que las reglas de acceso ocultar\u00edan de otro modo, incluso en documentos que no contienen formularios. Este problema est\u00e1 solucionado en la versi\u00f3n 1.7.15."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "security-advisories@github.com"}