CVE-2026-16753

Name of the Vulnerable Software and Affected Versions Lowcoder versions prior to 2.4.11

Description An authorization bypass exists in the LibraryQuery API within the service layer, where organization-scope checks are not enforced. This allows an authenticated user with an administrator or developer role to execute library queries or retrieve metadata belonging to another organization by sending a crafted request containing the victim's library-query identifier. This issue can lead to cross-tenant data exfiltration of stored queries, data sources, and potentially embedded credentials. The vulnerability is particularly impactful if LOWCODER EMAIL SIGNUP ENABLED is set to true, as this grants the required roles by default to self-signup accounts.

Recommendations Update to a version newer than 2.4.10. Disable LOWCODER EMAIL SIGNUP ENABLED or implement manual approval workflows for new accounts. Audit logs for LibraryQuery API calls that originate from unexpected organization IDs.