Lowcoder Flaw Lets One Tenant Run Another Tenant's Saved Queries

A developer or admin in one organization on a shared Lowcoder instance can reach another organization’s Query Library. CERT/CC confirmed the missing organization check in 2.4.10: metadata retrieval exposes saved-query DSL, configuration and datasourceId values, while execution can return data from the other organization’s backend source. The CVE Program record lists 2.1.0 through 2.4.10 as affected and describes the execution route. A signed-in admin or dev in their own organization is required. When LOWCODER_EMAIL_SIGNUP_ENABLED and LOWCODER_CREATE_WORKSPACE_ON_SIGNUP are both TRUE, self-signup accounts receive the required role by default.

Find shared deployments, their running versions, Query Library use, privileged-role assignments and both signup settings. Restrict metadata-retrieval and query-execution API access at the application or ingress layer; limit access to trusted users, and isolate organizations on separate instances where necessary. Source modifications should check organization ownership for both operations. CERT/CC reports that the vendor could not be reached and recommends endpoint restriction until an official security update is available. CERT/CC provides no attack request signature; check account access, route reachability and restriction policy when triaging. Confirm with an authorized test account outside the permitted access group that Query Library access is denied, then verify existing admin and dev assignments remain intentional.