CERT/CC: VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration
CERT/CC has published a new security advisory. Here is a summary and what to do.
Key points
- New advisory from CERT/CC.
- Review affected versions in the advisory.
- Apply updates promptly.
CERT/CC published a security advisory titled “VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration”.
At a glance
- Publisher
- CERT/CC
- CVEs
- CVE-2026-16753
What the advisory says
Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. Description CVE-2026-16753 Lowcoder is an open-source low-code platform that allows individuals with minimal coding experience to build web applications through a visual drag-and-drop interface. Each Lowcoder project contains a centralized Query Library which stores the workspace’s data queries and sources for quick reuse; however, the LibraryQuery API service layer lacks organization-scope checks at two endpoints: metadata retrieval and query execution. While the application features a role-based access mechanism (requires admin or dev ), it only checks the role’s validity against the user’s own organization. The vulnerable
What should you do?
- Read the full vendor advisory linked below and confirm whether you run affected versions.
- Schedule the recommended update, prioritising internet-facing systems.
- Watch for exploitation reports; unpatched edge devices are frequent targets.
What to do and how to stay safe: CVE-2026-16753
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
