CVE-2026-111666 in Steedos Platform
Summary
by MITRE • 10/16/2026
Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.