CVE-2026-55664

Name of the Vulnerable Software and Affected Versions Grist versions prior to 1.7.15

Description The 'GET /forms' endpoint fails to apply document access rules when reading table and column metadata and does not verify if the requested section is a form. This allows a user with partial read access, including public access to a publicly viewable document, to request metadata for any widget and reveal the table and column structure that should be hidden by access rules, regardless of whether the document contains forms.

Recommendations Update to version 1.7.15.