CVE-2026-53536

Name of the Vulnerable Software and Affected Versions Activepieces versions prior to 0.83.0

Description The '/v1/step-files/signed' download endpoint fails to verify the audience of the supplied JSON Web Token (JWT) and lacks a null-check on the decoded fileId. This allows an authenticated user with any valid JWT to retrieve a step-file attachment belonging to another tenant on the same instance. The specific file returned depends on the PostgreSQL scan order for the type FLOW STEP FILE, meaning attackers cannot target a specific victim or file. Access is read-only.

Recommendations Update to version 0.83.0.