Read the docs
TI-2026-40186 Aliases CVE-2026-55664

Grist: Insufficient access control in the /forms endpoint exposes table metadata

Priority LOW 20CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-285.

Summary

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actually a form. A user with only partial read access, including public access on a publicly viewable document, could request the metadata of any widget and reveal table and column structure that access rules would otherwise hide, even in documents that contain no forms. This issue is fixed in version 1.7.15.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00331 26th percentileScored 2026-11-07
Fix Fixed grist-core (gristlabs): 1.7.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gristlabsgrist-corebefore 1.7.151.7.15Patch availableCNA
  • grist-core Vendorgristlabs Affected before 1.7.15 Fixed in 1.7.15 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:getgrist:grist-core:*:*:*:*:*:*:*:*——gristlabs
  • cpe:2.3:a:getgrist:grist-core:*:*:*:*:*:*:*:* Versions — — ·gristlabs

Remediation

  • Fix · CNA grist-core (gristlabs) Fixed in 1.7.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55664

References

Other 3

  • TI-2026-19341 pyodide sandbox option is insecure CVSS 3.1CRITICAL 9.6
  • TI-2026-40187 DOM-based XSS in Grist via unsanitized links, enabling privilege escalation CVSS 4.0HIGH 8.5
  • TI-2024-37319 Cross-site Scripting vulnerability through HyperLink cells in grist-core CVSS 3.1HIGH 8.1
  • TI-2024-37318 Cross-site Scripting vulnerability through svg attachment previews in grist-core CVSS 3.1HIGH 8.1
  • TI-2024-37317 Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core CVSS 3.1HIGH 8.1
  • TI-2026-40182 Grist: XSS through unsafe value interpolation in server-rendered pages CVSS 3.1HIGH 7.7
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences