CVE-2026-55664

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55664", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-17T00:05:03.777Z", "datePublished": "2026-07-10T20:59:12.603Z", "dateUpdated": "2026-07-13T18:55:09.131Z"}, "containers": {"cna": {"title": "Grist: Insufficient access control in the /forms endpoint exposes table metadata", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-w2hc-w6cg-xvh9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-w2hc-w6cg-xvh9"}, {"name": "https://github.com/gristlabs/grist-core/commit/14694156fe99c438c5f7a452ad367e933bb194db", "tags": ["x_refsource_MISC"], "url": "https://github.com/gristlabs/grist-core/commit/14694156fe99c438c5f7a452ad367e933bb194db"}, {"name": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15", "tags": ["x_refsource_MISC"], "url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15"}], "affected": [{"vendor": "gristlabs", "product": "grist-core", "versions": [{"version": "< 1.7.15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T20:59:12.603Z"}, "descriptions": [{"lang": "en", "value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actually a form. A user with only partial read access, including public access on a publicly viewable document, could request the metadata of any widget and reveal table and column structure that access rules would otherwise hide, even in documents that contain no forms. This issue is fixed in version 1.7.15."}], "source": {"advisory": "GHSA-w2hc-w6cg-xvh9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T18:34:28.495573Z", "id": "CVE-2026-55664", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:55:09.131Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55664", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:34:28.495573Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:34:31.598Z"}}], "cna": {"title": "Grist: Insufficient access control in the /forms endpoint exposes table metadata", "source": {"advisory": "GHSA-w2hc-w6cg-xvh9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "gristlabs", "product": "grist-core", "versions": [{"status": "affected", "version": "< 1.7.15"}]}], "references": [{"url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-w2hc-w6cg-xvh9", "name": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-w2hc-w6cg-xvh9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gristlabs/grist-core/commit/14694156fe99c438c5f7a452ad367e933bb194db", "name": "https://github.com/gristlabs/grist-core/commit/14694156fe99c438c5f7a452ad367e933bb194db", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15", "name": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actually a form. A user with only partial read access, including public access on a publicly viewable document, could request the metadata of any widget and reveal table and column structure that access rules would otherwise hide, even in documents that contain no forms. This issue is fixed in version 1.7.15."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T20:59:12.603Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55664", "state": "PUBLISHED", "dateUpdated": "2026-07-13T18:55:09.131Z", "dateReserved": "2026-06-17T00:05:03.777Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T20:59:12.603Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "grist-core", "vendor": "gristlabs", "versions": [{"status": "affected", "version": "< 1.7.15"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actually a form. A user with only partial read access, including public access on a publicly viewable document, could request the metadata of any widget and reveal table and column structure that access rules would otherwise hide, even in documents that contain no forms. This issue is fixed in version 1.7.15."}, {"lang": "es", "value": "Grist es un software de hoja de c\u00e1lculo que utiliza Python como su lenguaje de f\u00f3rmulas. Antes de 1.7.15, el endpoint GET /forms le\u00eda los metadatos de tablas y columnas sin aplicar las reglas de acceso del documento y no verificaba que la secci\u00f3n solicitada fuera realmente un formulario. Un usuario con solo acceso de lectura parcial, incluyendo acceso p\u00fablico en un documento visible p\u00fablicamente, pod\u00eda solicitar los metadatos de cualquier widget y revelar la estructura de tablas y columnas que las reglas de acceso ocultar\u00edan de otro modo, incluso en documentos que no contienen formularios. Este problema est\u00e1 solucionado en la versi\u00f3n 1.7.15."}], "id": "CVE-2026-55664", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55664", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-13T18:34:28.495573Z", "version": "2.0.3"}}]}, "published": "2026-07-10T21:16:56.723", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gristlabs/grist-core/commit/14694156fe99c438c5f7a452ad367e933bb194db"}, {"source": "security-advisories@github.com", "url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15"}, {"source": "security-advisories@github.com", "url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-w2hc-w6cg-xvh9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-285"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.15)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "grist-core", "source": "cna", "vendor": "gristlabs"}, "product": "grist-core", "vendor": "gristlabs"}], "created": "2026-07-10T22:30:04.414038+00:00", "updated": "2026-08-01T12:15:03.409196+00:00", "vendors": ["gristlabs", "gristlabs$PRODUCT$grist-core"]}