Threats tagged 'ghsa-h4gg-p9rv-rcg5'

Grida versions up to 0.0.24 have a missing authorization vulnerability in the Forms file-preview API routes. This flaw allows unauthenticated attackers to access form response files from other organizations by exploiting exposed form and field IDs to retrieve service-role signed URLs for attachments and Supabase bucket objects. The vulnerability has a medium severity with a CVSS score of 5.9.