CVE-2026-111666 steedos CVE debrief

Who should care

Steedos Platform administrators, security teams, and users with access to the reports object should assess exposure and verify the vulnerability. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed to ensure proper mitigation and remediation.

Why it matters

CVE-2026-111666 is a medium-severity vulnerability in Steedos Platform that allows authenticated users to bypass authorization and read other tenants' report definitions. Steedos Platform administrators and security teams should verify and mitigate the vulnerability to prevent potential data exposure.

• Potential data exposure through unauthorized access to report definitions
• Need for verification of affected versions and scope of vulnerability
• Priority for updating to a fixed version or implementing compensating controls
• Importance of monitoring for suspicious activity on the /api/v1/reports endpoint

Technical summary

The Steedos Platform vulnerability allows authenticated users to read other tenants' report definitions due to objectql's callAdapter skipping space filtering for enable_space_global objects on find/findOne. This can be exploited via a GET /api/v1/reports request to disclose report names, descriptions, and object and field API names. Steedos Platform administrators and security teams should verify and mitigate the vulnerability to prevent potential data exposure. The CVE record and NVD entry provide details on the vulnerability, but further verification is required to determine the full impact.

Defensive priority

Medium priority for Steedos Platform administrators and security teams to verify and mitigate the vulnerability.

Recommended defensive actions

• Verify Steedos Platform version and check for updates to 3.0.15-beta.52 or later
• Restrict access to the reports object and implement additional authentication checks
• Monitor for suspicious activity on the /api/v1/reports endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the exact scope of affected versions and potential exploitation remains limited. Further verification is required to determine the full impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.