Description
Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows unauthenticated attackers to read other organizations' form response files. Attackers can use form and field IDs exposed in public form payloads with a chosen path parameter to obtain service-role signed URLs for attachments and connected Supabase bucket objects.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gridaco | grida | ≤ 0.0.24 | — |
References
- GitHub Issue #1107 issue-tracking
- https://github.com/gridaco/grida product
- Fix pull request #1108 issue-tracking patch
- Fix commit 05f5a54 patch
- file/preview/src route handler technical-description
- Researcher write-up technical-description
- VulnCheck Advisory: Grida through 0.0.24 Missing Authorization in Forms File-Preview API third-party-advisory