Security readout for executives and security teams
Plain-English summary
An authenticated user who can author flows may cross tenant boundaries on a shared Activepieces worker. They could read cached flow data, alter another tenant’s cached code, and cause that code to run during the victim’s next flow execution. This threatens confidential workflow data and downstream systems reached by affected flows.
Executive priority
Treat this as an immediate upgrade and investigation priority for multitenant deployments. The combination of cross-tenant confidentiality loss and code modification could expose business data or misuse connected systems, even though active exploitation has not been reported in the supplied evidence.
Technical view
Before Activepieces 0.84.0, an unsanitized path segment in the Code piece sandbox cache permits read-write access to other tenants’ cached flow and code files on the same worker. The issue requires authenticated flow-author privileges, needs no victim interaction, and is rated CVSS 4.0 9.3.
Likely exposure
Exposure is highest for Activepieces versions earlier than 0.84.0 where multiple tenants share workers and potentially untrusted users have authenticated flow-author access. Single-tenant or tightly controlled-author deployments may have lower practical exposure, but the supplied sources do not establish immunity.
Exploitation context
The supplied bundle reports no CISA KEV listing and provides no evidence of active exploitation. Exploitation requires authenticated flow-author access, but is otherwise described as low complexity, network reachable, and requiring no victim interaction.
Researcher notes
The reported weakness combines path sanitization failure with inadequate tenant authorization around shared cached files. Relevant mappings are CWE-200, CWE-285, CWE-668, and CWE-732. The bundle identifies the fixing commit and release, but does not provide telemetry indicators, affected hosting configurations, or evidence establishing exploitation in the wild.
Mitigation direction
- Upgrade every affected Activepieces deployment to version 0.84.0 or later.
- Until upgraded, restrict flow-author access to trusted users.
- Avoid placing mutually untrusted tenants on the same worker until remediation is complete.
- Review the vendor advisory for additional deployment-specific guidance.
Validation and detection
- Inventory Activepieces deployments and confirm their running versions.
- Identify workers shared by multiple tenants and enumerate users with flow-author access.
- Review cached flow and code files for unexpected changes or cross-tenant access indicators.
- Investigate unusual victim flow executions and downstream actions around suspected modifications.
- Confirm version 0.84.0 or later is active on every worker after upgrading.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-668: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-732: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-48499 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/activepieces/activepieces/security/advisories/GHSA-5h2x-g6m3-grmqCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/activepieces/activepieces/commit/9d8d328424bd32d295c5727af7550e1b57f9074dCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/activepieces/activepieces/releases/tag/0.84.0CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.