steedos CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM steedos CVE published 2026-10-16

CVE-2026-111666

Steedos Platform versions through 3.0.15-beta.51 contain an authorization bypass vulnerability. Authenticated users can read other tenants' report definitions by querying the reports object due to objectql's callAdapter skipping space filtering for enable_space_global objects on find/findOne. This allows attackers to disclose report names, descriptions, and object and field API names via a GET /api/v1/rep [truncated]