Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. Description CVE-2026-16753 Lowcoder is an open-source low-code platform that allows individuals with minimal coding experience to build web applications through a visual drag-and-drop interface.
VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration
About this summary. This is a short excerpt from the description that CERT/CC published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://kb.cert.org/vuls/id/382143
Source attribution: headline and facts are from CERT/CC (kb.cert.org). Summary method: excerpt of the source description. See our source attribution policy.