CVE-2026-53536

🗓️ 16 Jul 2026 18:48:30Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 56 Views🌐 WEB

Activepieces before 0.83.0 allowed cross-tenant file download due to missing JSON Web Token audience check and null fileId verification on signed URLs.

Reporter	Title	Published	Views	Family All 8
attackerkb	CVE-2026-53536	16 Jul 202618:48	–	attackerkb
Circl	CVE-2026-53536	16 Jul 202620:35	–	circl
Cvelist	CVE-2026-53536 Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL	16 Jul 202618:48	–	cvelist
EUVD	EUVD-2026-45027	16 Jul 202618:48	–	euvd
NVD	CVE-2026-53536	16 Jul 202619:16	–	nvd
Positive Technologies	PT-2026-60559	16 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-53536: Insufficient Verification of Data Authenticity	16 Jul 202600:00	–	rapid7
Vulnrichment	CVE-2026-53536 Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL	16 Jul 202618:48	–	vulnrichment

Vulners

Node

activepieces activepiecesRange<0.83.0

[
  {
    "vendor": "activepieces",
    "product": "activepieces",
    "versions": [
      {
        "version": "< 0.83.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/activepieces/activepieces/commit/2cb6148010a6c2a22900f4c8b08d75cc5c921d1c
github	www.github.com/activepieces/activepieces/releases/tag/0.83.0
github	www.github.com/activepieces/activepieces/commit/afe852f60e39fcc6273d41e11f0765586b5a0e49
github	www.github.com/activepieces/activepieces/security/advisories/GHSA-9723-fmff-mc24

Parameter	Position	Path	Description	CWE
Authorization header	path	/v1/step-files/signed	The endpoint failed to verify the JWT audience and did not properly validate the decoded fileId, enabling access to step-files belonging to other tenants using any valid JWT (read-only) before fix.	CWE-345, CWE-639
fileId	path	/v1/step-files/signed	The endpoint failed to verify the JWT audience and did not properly validate the decoded fileId, enabling access to step-files belonging to other tenants using any valid JWT (read-only) before fix.	CWE-345, CWE-639

18 Jul 2026 03:16Current

5.9Medium risk

Vulners AI Score5.9

CVSS 45.3

EPSS0.00236

SSVC