Lowcoder flaw exposes cross-tenant query data
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
An authorization bypass in Lowcoder 2.4.10's Query Library API lets any admin/dev user read or execute other tenants' private queries.
CERT/CC has published VU#382143 describing an authorization bypass in Lowcoder, an open-source low-code platform, affecting its Query Library API in multi-tenant deployments. The LibraryQuery service layer validates that a requesting user has an admin or dev role, but fails to check whether the requested query resource belongs to the requester's own organization. Because self-signup accounts are granted admin/dev roles by default when LOWCODER_EMAIL_SIGNUP_ENABLED and LOWCODER_CREATE_WORKSPACE_ON_SIGNUP are enabled, any authenticated user on a shared instance can potentially exploit this.
An attacker exploiting this flaw (tracked as CVE-2026-16753) can retrieve the full DSL configuration of other organizations' library queries, including referenced data source IDs, and execute those queries to receive live response data from the victim organization's backend data sources. This enables cross-tenant data exposure, data modification or destruction, and cost abuse by querying another tenant's paid data sources on their account. There is no indication of in-the-wild exploitation; this is vulnerability disclosure rather than active campaign reporting.
Lowcoder could not be reached to coordinate a fix, so no official patch exists at time of publication. CERT/CC recommends administrators restrict access to the affected Query Library API endpoints, limit application access to trusted users, review admin/dev role assignments, and consider isolating tenants into separate instances. Where source modification is feasible, organizations should add explicit organization-level authorization checks to the metadata retrieval and query execution endpoints.
Mentioned in this report
Detection guidance
Lowcoder Library Query DSL Retrieval or Execution via Query Library API
Detects successful requests to Lowcoder Query Library API endpoints that fetch library query DSL or execute library queries, the calls abused in the CVE-2026-16753 cross-tenant authorization bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Lowcoder Library Query DSL Retrieval or Execution via Query Library API
id: 2896a873-d4c3-5a05-a273-3137af3d5385
status: experimental
description: Detects successful requests to Lowcoder Query Library API endpoints that
retrieve library query metadata/DSL or execute library queries. Per CERT/CC VU#382143
(CVE-2026-16753) these calls lack an organization-ownership check, so any authenticated
admin/dev user (including self-signup accounts) can read or run another tenant's
queries. The rule cannot see tenant ownership; triage by comparing the requester's
organization with the organization that owns the queried resource, and by looking
for a burst of calls from a recently created account. Endpoint path is based on
the Lowcoder Query Library API naming and should be tuned to your deployment.
references:
- https://kb.cert.org/vuls/id/382143
tags:
- attack.collection
- attack.t1530
- attack.initial-access
- attack.t1078
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains: /library-queries
selection_action:
cs-uri-stem|contains:
- /execute
- /dsl
- /listByOrg
selection_status:
sc-status:
- 200
- 201
condition: selection_path and selection_action and selection_status
falsepositives:
- Legitimate developers in a Lowcoder tenant running or editing their own organization's
library queries
- Scheduled or automated application workflows that execute library queries through
the API
level: low
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/382143
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs