VU#382143 Lowcoder Query Library flaw allows cross-tenant data access
3rd article in the last 90 days, one of 3 articles referencing VU. Previous coverage: CERT/CC advisory VU#456950 covers Komodo Periphery command injection flaw (Oct 2026).
Companies mentioned
Best suited for
- Seniority
- Staff
- Job function
- Cybersecurity / Information Security
- Persona
- Security Operations Practitioner
- Buyer role
- Technical Implementer / Administrator
- Decision stage
- Post Buy
- Adoption curve
- Early Majority
- Technology maturity
- Established Technology
- Industry
- Information Technology / Software & Services / Software / Low-Code / No-Code Platforms
Our classification, not the publisher's statement. Best suited for, not only for.
Lowcoder version 2.4.10, an open-source low-code platform for building web applications through a visual drag-and-drop interface, contains an authorization bypass vulnerability in the API for its Query Library feature. The flaw allows authenticated users with the admin or dev role to access private library-query data from other organizations on a multi-tenant instance.
The vulnerability is identified as CVE-2026-16753 and was confirmed against Lowcoder version 2.4.10. Each Lowcoder project includes a centralized Query Library that stores the workspace's data queries and sources for reuse. The LibraryQuery API service layer lacks organization-scope checks at two endpoints, one handling metadata retrieval and one handling query execution. Role-based access requires the admin or dev role, but the check confirms that role only against the requesting user's own organization. The vulnerable endpoints do not verify whether the requested resource belongs to the requester's organization.
An authenticated user holding the admin or dev role in any organization on a multi-tenant Lowcoder instance can access other tenants' Query Libraries. Those roles are granted by default to any self-signup account when LOWCODER_EMAIL_SIGNUP_ENABLED and LOWCODER_CREATE_WORKSPACE_ON_SIGNUP are set to TRUE. Using this access, an attacker can read the full Domain Specific Language (DSL) of another organization's library queries, including complete query configuration and each referenced datasourceId.
An attacker can also execute any library query available on the instance and receive response data directly from the affected organization's backend data source. Potential impacts include cross-tenant data exposure, modification, or destruction, as well as cost abuse through querying paid data sources at another tenant's expense. Because organization-level authorization is bypassed, data isolation between organizations is violated and the instance can effectively function as a shared environment for attackers.
Lowcoder could not be reached to coordinate this vulnerability. The document was first published on 2026-10-13 and last updated on 2026-10-13 at 19:21 UTC as revision 1. Louis Sanchez, a member of Voke Cyber, reported the vulnerability, and Alex Lewis wrote the document.
Lowcoder administrators should limit access to the affected Query Library API endpoints until an official security update is released. Exposure can be reduced by restricting application access to trusted users and reviewing admin and dev role assignments. Organizations running multi-tenant deployments may consider separating tenants into distinct instances to prevent cross-organization data access. Where source code can be modified, administrators should add organization-level authorization checks for Query Library metadata retrieval and query execution.
Blog post, originally published by Alex Lewis at kb.cert.org.