CVE-2026-55664

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actually a form. A user with only partial read access, including public access on a publicly viewable document, could request the metadata of any widget and reveal table and column structure that access rules would otherwise hide, even in documents that contain no forms. This issue is fixed in version 1.7.15.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/gristlabs/grist-core/commit/14694156fe99c438c5f7a452ad367e933bb194db
https://github.com/gristlabs/grist-core/releases/tag/v1.7.15
https://github.com/gristlabs/grist-core/security/advisories/GHSA-w2hc-w6cg-xvh9

Configurations

No configuration.

History

10 Jul 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-10 21:16

Updated : 2026-07-13 19:17

NVD link : CVE-2026-55664

Mitre link : CVE-2026-55664

CVE.ORG link : CVE-2026-55664

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-285

Improper Authorization

{"id": "CVE-2026-55664", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55664", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:34:28.495573Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gristlabs", "product": "grist-core", "versions": [{"status": "affected", "version": "< 1.7.15"}]}]}], "published": "2026-07-10T21:16:56.723", "references": [{"url": "https://github.com/gristlabs/grist-core/commit/14694156fe99c438c5f7a452ad367e933bb194db", "source": "security-advisories@github.com"}, {"url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15", "source": "security-advisories@github.com"}, {"url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-w2hc-w6cg-xvh9", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actually a form. A user with only partial read access, including public access on a publicly viewable document, could request the metadata of any widget and reveal table and column structure that access rules would otherwise hide, even in documents that contain no forms. This issue is fixed in version 1.7.15."}], "lastModified": "2026-07-13T19:17:14.547", "sourceIdentifier": "security-advisories@github.com"}