ZeroDay Findings
Sign inSign up

Findings

CVE-2026-16753

VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration

Published Oct 14, 2026 · CERT/CC

Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. Description CVE-2026-16753 Lowcoder is an open-source low-code platform that allows individuals with minimal coding experience to build web applications through a visual drag-and-drop interface. Each Lowcoder project cont

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · CERT/CC Vulnerability Notes

    Detected

    Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. Description CVE-2026-16753 Lowcoder is an open-source low-code platform that allows individuals with minimal coding experience to bu

Sources

  • CERT/CC Vulnerability NotesGovernment advisoryCVE-2026-16753

    Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. Description

    kb.cert.org
  • CVE.orgVulnerability recordCVE-2026-16753

    Official CVE identifier

    cve.org