VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration

CVE-2026-16753 affects Lowcoder 2.4.10, an open-source low-code platform. The vulnerability arises because the Query Library API does not verify that requested resources belong to the requester's organization, despite role-based access checks. Authenticated users with admin or dev roles can bypass organization-level authorization to read and execute queries from other tenants within a multi-tenant instance. This leads to unauthorized data exposure, potential data modification or destruction, and cost abuse by querying paid data sources under another tenant's account. The vulnerability was confirmed in version 2.4.10. No coordinated vendor fix is available.

Any authenticated user with admin or dev privileges in any organization on a multi-tenant Lowcoder instance can access and execute query data from other organizations. This compromises data isolation, allowing cross-tenant data exfiltration, potential data modification or destruction, and financial abuse through unauthorized queries on paid data sources. The vulnerability undermines the security model of multi-tenant deployments by effectively turning them into shared environments accessible by attackers with certain roles.

No official fix is currently available. Administrators should restrict access to the vulnerable Query Library API endpoints until a security update is released. Limiting application access to trusted users and reviewing admin and dev role assignments can reduce exposure. Organizations should consider isolating tenants into separate Lowcoder instances to prevent cross-organization data access. Where possible, source code modifications should be made to enforce organization-level authorization checks on metadata retrieval and query execution endpoints.