CVE-2026-111666

Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enablespaceglobal objects on find/findOne,...

CVE-2026-111666

Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enablespaceglobal objects on find/findOne,...

EUVD-2026-102957

Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enablespaceglobal objects on find/findOne,...

PT-2026-116065

Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable space global objects on find/findOne,...

CVE-2026-111666: Incorrect Authorization

Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enablespaceglobal objects on find/findOne,...

Steedos Platform Authorization Vulnerability

The Steedos Platform versions 3.0.15-beta.51 and earlier have an authorization issue vulnerability. This vulnerability stems from objectql’s callAdapter, which skips space filtering for the enablespaceglobal object during the find/findOne operation. As a result, authenticated attackers can read t...