CVE-2026-55664 Details
Description
Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actually a form. A user with only partial read access, including public access on a publicly viewable document, could request the metadata of any widget and reveal table and column structure that access rules would otherwise hide, even in documents that contain no forms. This issue is fixed in version 1.7.15.
A vulnerability in Grist spreadsheet software prior to version 1.7.15 allows for unauthorized access to table and column metadata through the GET /forms endpoint. This issue arises because the endpoint did not properly enforce access rules, enabling users with partial read access, including public access on publicly viewable documents, to request metadata from any widget. As a result, sensitive table and column structures could be revealed, even in documents lacking forms.
Users can upgrade to Grist version 1.7.15 or later to address this vulnerability. Instructions for downloading the latest version are available on the Grist GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gristlabs/grist-core/commit/14694156fe99c438c5f7a452ad367e933bb194db | [email protected] | Source CodeVendor |
| https://github.com/gristlabs/grist-core/releases/tag/v1.7.15 | [email protected] | Release NotesVendor |
| https://github.com/gristlabs/grist-core/security/advisories/GHSA-w2hc-w6cg-xvh9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grist | < 1.7.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |