Lowcoder: Incorrect authorization in library query execution
Summary
Lowcoder, an open-source low-code platform, contains an incorrect authorization flaw in its library query execution endpoint. An authenticated administrator or developer in one organization can execute a library query belonging to another organization by sending a crafted request containing the victim library query identifier. Attackers may thereby reach the backend data sources connected to those queries, so the risk is mainly relevant for multi-organization deployments.
Affected
- Lowcoder versions 2.1.0 up to and including 2.4.10
Fixed in
Unknown. No fixed version was found at the time of research.
Workaround
- Restrict access to the affected Query Library API endpoints until an official security update is available
- Isolate tenants into separate Lowcoder instances
- Where source code can be changed, add organization-level authorization checks for Query Library metadata retrieval and query execution
Exploitation
- Not listed as known exploited
- No public proof of concept found
- CISA SSVC assessment: exploitation none, automatable no, technical impact total
Our recommendation
- Check whether the instance hosts more than one organization; if not, the priority is lower
- Limit admin and developer roles to the minimum required
- Review library queries that hold credentials for backend data sources and rotate those credentials
- Review logs for unexpected library query execution
- Monitor the GitHub repository and CERT/CC VU#382143 for a vendor fix and apply it promptly
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT/CC VU#382143 www.kb.cert.org
- Lowcoder GitHub repository github.com
- OSV: CVE-2026-16753 osv.dev
- VulDB CVE-2026-16753 vuldb.com
- HOL Guard: CVE-2026-16753 hol.org
- CERT/CC VU#382143 republication (Vistanet) www.vistanetinc.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:14.
Original description (NVD)
Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.