Security readout for executives and security teams
Plain-English summary
Activepieces before 0.83.0 could let a logged-in user on a shared instance download a step-file attachment from another tenant. This is a confidentiality issue: sources say files were not targetable, access was read-only, and integrity and availability were unaffected.
Executive priority
Prioritize remediation for shared Activepieces environments because tenant file attachments may contain sensitive workflow data. This is not a takeover or service outage issue, but cross-tenant confidentiality bugs can create customer trust, privacy, and contractual impact.
Technical view
The step-files signed download endpoint accepted any valid Activepieces JWT signed with the shared secret without checking audience. A missing null-check on decoded fileId caused PostgreSQL to return whichever FLOW_STEP_FILE row was scanned first, enabling cross-tenant file disclosure.
Likely exposure
Exposure is most relevant to self-hosted or managed Activepieces instances below 0.83.0 with multiple tenants or untrusted authenticated users. Single-tenant deployments have lower practical exposure, but should still upgrade because the vulnerable access-control path exists.
Exploitation context
No active exploitation is cited, and the CVE is not listed as KEV in the provided bundle. Exploitation requires a valid Activepieces JWT, such as a normal user access token. Sources say attackers could not choose a specific victim or file.
Researcher notes
The vulnerability combines improper authentication token validation with object authorization weakness. The random file selection behavior limits targeted abuse but does not remove impact. Assessment should focus on pre-0.83.0 code paths, tenant isolation assumptions, and whether exposed step-files contained sensitive material.
Mitigation direction
- Upgrade Activepieces to version 0.83.0 or later.
- Follow Activepieces security advisory guidance for affected deployments.
- Limit tenant access and user creation until upgraded.
- Review step-file exposure risk for shared or multi-tenant instances.
Validation and detection
- Inventory Activepieces deployments and confirm versions are at least 0.83.0.
- Identify shared instances with multiple tenants or untrusted authenticated users.
- Confirm the signed download logic validates JWT audience after upgrade.
- Review access logs for unusual step-file signed download activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-345: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-53536 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/activepieces/activepieces/security/advisories/GHSA-9723-fmff-mc24CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/activepieces/activepieces/commit/2cb6148010a6c2a22900f4c8b08d75cc5c921d1cCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/activepieces/activepieces/commit/afe852f60e39fcc6273d41e11f0765586b5a0e49CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/activepieces/activepieces/releases/tag/0.83.0CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.