CVE-2026-111666 — Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API
Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the …
Published: 2026-10-16 · CVSS: 5.3 · CVSS 4.0
Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7