CVE-2026-53536

🗓️ 16 Jul 2026 18:48:30Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 60 Views🌐 WEB

Activepieces before 0.83.0 allowed cross-tenant file download due to missing JSON Web Token audience check and null fileId verification on signed URLs.

Reporter	Title	Published	Views	Family All 9
attackerkb	CVE-2026-53536	16 Jul 202618:48	–	attackerkb
Circl	CVE-2026-53536	16 Jul 202620:35	–	circl
Cvelist	CVE-2026-53536 Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL	16 Jul 202618:48	–	cvelist
EUVD	EUVD-2026-45027	16 Jul 202618:48	–	euvd
Mend	CVE-2026-53536	16 Jul 202618:48	–	mend
NVD	CVE-2026-53536	16 Jul 202619:16	–	nvd
Positive Technologies	PT-2026-60559	16 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-53536: Insufficient Verification of Data Authenticity	16 Jul 202600:00	–	rapid7
Vulnrichment	CVE-2026-53536 Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL	16 Jul 202618:48	–	vulnrichment

Vulners

Node

activepieces activepiecesRange<0.83.0

[
  {
    "vendor": "activepieces",
    "product": "activepieces",
    "versions": [
      {
        "version": "< 0.83.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/activepieces/activepieces/commit/2cb6148010a6c2a22900f4c8b08d75cc5c921d1c
github	www.github.com/activepieces/activepieces/releases/tag/0.83.0
github	www.github.com/activepieces/activepieces/commit/afe852f60e39fcc6273d41e11f0765586b5a0e49
github	www.github.com/activepieces/activepieces/security/advisories/GHSA-9723-fmff-mc24

Parameter	Position	Path	Description	CWE
Authorization	header	/v1/step-files/signed	The /v1/step-files/signed endpoint fails to verify the 'aud' (audience) claim in the JWT and lacks a null-check on the decoded fileId, allowing any authenticated user to retrieve a step-file belonging to another tenant.	CWE-345, CWE-639

18 Jul 2026 03:16Current

5.8Medium risk

Vulners AI Score5.8

CVSS 45.3

EPSS0.00236

SSVC