Summary
Lowcoder contains an authorization flaw in its library-query execution endpoint that may let an authenticated administrator or developer execute a library query owned by another organization.
The issue becomes risky when the endpoint relies on a supplied library-query identifier without verifying that the referenced object belongs to the caller's organization.
Lowcoder contains an authorization flaw in its library-query execution endpoint that may let an authenticated administrator or developer execute a library query owned by another organization.
The issue becomes risky when the endpoint relies on a supplied library-query identifier without verifying that the referenced object belongs to the caller's organization.
Affected context
The vulnerability occurs in Lowcoder deployments where users with authenticated administrator or developer privileges can access the library-query execution endpoint. It may be present when the endpoint accepts a library-query identifier and does not consistently enforce organization ownership or tenant boundaries before execution.
The vulnerability occurs in Lowcoder deployments where users with authenticated administrator or developer privileges can access the library-query execution endpoint. It may be present when the endpoint accepts a library-query identifier and does not consistently enforce organization ownership or tenant boundaries before execution.
Exploit preconditions
- Attack surface: Authenticated library-query execution API
- Required access: Administrator or developer privileges in an organization
- Trigger point: A request that references a library-query identifier
- Cross-tenant condition: The referenced identifier belongs to another organization
- Why exploitation is possible: Authorization checks may validate the caller's general role without confirming ownership of the requested library-query object
- Attack surface: Authenticated library-query execution API
- Required access: Administrator or developer privileges in an organization
- Trigger point: A request that references a library-query identifier
- Cross-tenant condition: The referenced identifier belongs to another organization
- Why exploitation is possible: Authorization checks may validate the caller's general role without confirming ownership of the requested library-query object
Why this happens
The underlying bug is an object-level authorization failure. The endpoint appears to authorize the request based on the user's authenticated role but does not adequately bind the requested library-query object to the caller's organization.
This maps primarily to CWE-639: Authorization Bypass Through User-Controlled Key and is also related to CWE-863: Incorrect Authorization, because a user-controlled identifier can select an object outside the permitted tenant scope.
The underlying bug is an object-level authorization failure. The endpoint appears to authorize the request based on the user's authenticated role but does not adequately bind the requested library-query object to the caller's organization.
This maps primarily to CWE-639: Authorization Bypass Through User-Controlled Key and is also related to CWE-863: Incorrect Authorization, because a user-controlled identifier can select an object outside the permitted tenant scope.
Potential impact
- An authenticated user may execute library queries owned by another organization
- Sensitive data returned by those queries could be exposed
- Queries may cause unauthorized changes or side effects, depending on their design
- Cross-tenant isolation could be weakened
- Activity records or downstream systems may be affected by unauthorized execution
- An authenticated user may execute library queries owned by another organization
- Sensitive data returned by those queries could be exposed
- Queries may cause unauthorized changes or side effects, depending on their design
- Cross-tenant isolation could be weakened
- Activity records or downstream systems may be affected by unauthorized execution
General mitigation guidance
Mitigation generally focuses on enforcing object-level authorization at the execution boundary rather than relying only on role checks.
Common defensive patterns include:
- Resolve the requested library-query object within the caller's organization scope
- Enforce tenant ownership and resource permissions on every execution request
- Prefer server-side authorization decisions over trust in client-supplied identifiers
- Apply least privilege to administrative and developer roles
- Use deny-by-default behavior when organization context or resource ownership is missing
- Avoid exposing cross-tenant identifiers or relying on identifier secrecy as an authorization control
- Add regression tests covering same-organization and cross-organization access attempts
Mitigation generally focuses on enforcing object-level authorization at the execution boundary rather than relying only on role checks.
Common defensive patterns include:
- Resolve the requested library-query object within the caller's organization scope
- Enforce tenant ownership and resource permissions on every execution request
- Prefer server-side authorization decisions over trust in client-supplied identifiers
- Apply least privilege to administrative and developer roles
- Use deny-by-default behavior when organization context or resource ownership is missing
- Avoid exposing cross-tenant identifiers or relying on identifier secrecy as an authorization control
- Add regression tests covering same-organization and cross-organization access attempts
How teams detect issues like this
Organizations can look for this issue through:
- Static and semantic analysis of endpoints that accept object identifiers
- Code review checks requiring tenant-scoped resource lookups before execution
- Tests that substitute identifiers from another organization and verify denial
- API gateway or policy rules requiring organization context for library-query operations
- Audit-log analysis for authenticated users executing resources outside their normal tenant
- Automated authorization testing tools that exercise horizontal privilege-boundary cases
Organizations can look for this issue through:
- Static and semantic analysis of endpoints that accept object identifiers
- Code review checks requiring tenant-scoped resource lookups before execution
- Tests that substitute identifiers from another organization and verify denial
- API gateway or policy rules requiring organization context for library-query operations
- Audit-log analysis for authenticated users executing resources outside their normal tenant
- Automated authorization testing tools that exercise horizontal privilege-boundary cases
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| kb. | kb.cert.org/ |
