Description

Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows unauthenticated attackers to read other organizations' form response files. Attackers can use form and field IDs exposed in public form payloads with a chosen path parameter to obtain service-role signed URLs for attachments and connected Supabase bucket objects.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-11-06T16:17:54.560Z",
  "pubdate": "2026-11-06T16:17:54.560Z",
  "executiveSummary": "Grida versions through 0.0.24 are susceptible to a critical broken access control vulnerability within the Forms file-preview API routes.\nThe flaw allows unauthenticated remote attackers to bypass authorization checks and access sensitive file attachments and Supabase bucket objects belonging to other organizations.\nBy manipulating specific API parameters, an attacker can coerce the system into generating signed URLs for files they are not authorized to view.\nThe vulnerability stems from improper validation of authorization tokens and user identity during the file-preview process, effectively failing to ensure that the requester has the necessary permissions to access requested resources.\nThe potential impact includes unauthorized data exfiltration of form-related sensitive information, breach of confidentiality, and regulatory non-compliance regarding data privacy.\nExploitation requires no prior authentication or administrative privileges, making it a high-risk security issue for deployments utilizing the affected Grida architecture.\nUsers are advised to restrict exposure and prioritize updates once patches are available.",
  "technicalDetails": "The vulnerability resides in the API route handling for form file-previews within the Grida application (versions 0.0.24 and earlier).\nThe root cause is a missing authorization check on the API endpoint responsible for generating service-role signed URLs for attachments stored in connected Supabase buckets.\nUnder normal operation, an application should verify that the requester is a member of the organization associated with the form ID and the specific file resource before granting access.\nHowever, the affected implementation fails to validate the request context, allowing any unauthenticated actor to interact with the backend service.\nThe exploitation flow proceeds as follows: First, an attacker identifies a valid form ID and field ID, which are often exposed within public form payloads or via open source code repositories. Second, the attacker interacts with the Forms file-preview API route, providing the known form and field identifiers combined with a chosen path parameter pointing to a target file object.\nBecause the server-side logic lacks requisite authorization checks, it processes the request and generates a service-role signed URL.\nThis signed URL provides the attacker with direct, read-access to the underlying Supabase bucket object, bypassing all organizational boundaries or data residency policies.\nThis behavior represents an insecure direct object reference (IDOR) pattern coupled with an authentication bypass.\nThe reliance on service-role credentials to sign these URLs amplifies the risk, as the system provides privileged access to objects without verifying the end-user identity.\nBecause the vulnerability exists at the API level, it is reachable via any network interface exposed to the public internet, provided the API endpoint is accessible.\nPost-exploitation, an attacker can iterate through systematically guessed or discovered file identifiers to harvest all attachments associated with any form in the instance, resulting in widespread unauthorized data exposure."
}