CVE-2025-64753: Grist-core Information Disclosure Vulnerability

CVE-2025-64753 Overview

CVE-2025-64753 is an authorization vulnerability in grist-core, an open-source spreadsheet hosting server maintained by Grist Labs. Versions prior to 1.7.7 fail to enforce full read access when serving document version history. A user with only partial read access to a document can query endpoints that list version hashes and retrieve the complete diff of changes between versions. The returned data may include cells, columns, or entire tables the user is not authorized to view. The issue is tracked as CWE-863: Incorrect Authorization and was resolved in version 1.7.7.

Critical Impact
Authenticated users with partial document access can exfiltrate restricted cells, columns, and tables by requesting version comparison data through the /compare endpoint.

Affected Products

Grist Labs grist-core versions prior to 1.7.7
Self-hosted Grist deployments relying on column, table, or row-level access rules
Grist installations exposing the document comparison and state history endpoints

Discovery Timeline

2025-11-13 - CVE-2025-64753 published to the National Vulnerability Database
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-64753

Vulnerability Analysis

Grist implements granular access controls that restrict visibility of specific cells, columns, rows, and tables within a document. These rules apply when a user reads live document data through the standard document APIs. However, the endpoints responsible for returning document version history and inter-version diffs did not apply the same access restrictions. A user with partial read access could enumerate version hashes and then request a comparison between two versions. The response contained the full set of changes, bypassing the per-table and per-column rules enforced elsewhere in the application.

Root Cause

The root cause is incorrect authorization on the /compare endpoint and related state-listing endpoints. The handler verified that the caller had some form of read access to the document but did not confirm the caller had full read access. Because version diffs reconstruct historical cell values across all tables, partial-access users received data outside their authorized scope.

Attack Vector

Exploitation requires an authenticated account with at least partial read access to a target document. The attacker issues HTTP requests to the version history endpoints to list state hashes, then calls /compare with two hashes to retrieve the full set of changes between versions. No user interaction and no elevated privileges are required beyond the initial document share. The vulnerability does not permit modification of data or denial of service — the impact is confined to confidentiality.

No verified public exploit code is available. Technical details are documented in the vendor advisory GHSA-3v78-cw58-v685.

Detection Methods for CVE-2025-64753

Indicators of Compromise

Requests to the /compare endpoint originating from accounts that hold only partial read access to the targeted document
Unusual enumeration of /states endpoints followed by paired /compare requests across historical version hashes
Access log entries showing low-privilege accounts repeatedly pulling version diffs for documents containing restricted tables or columns

Detection Strategies

Review Grist application logs for /compare and /states requests and correlate the requesting user against the document access rules defined for that document
Audit document access rules to identify documents where partial read access is granted, then search historical logs for prior access to version comparison endpoints
Flag any API client or integration token that calls /compare without owner or full-editor permissions on the document

Monitoring Recommendations

Enable verbose HTTP access logging on the Grist server and forward logs to a centralized analytics or SIEM platform for retention and query
Build alerts on repeated /compare calls from a single session, which indicate systematic version diff harvesting
Monitor upgrades to confirm all Grist instances are running 1.7.7 or later and alert on any instance reporting an older version string

How to Mitigate CVE-2025-64753

Immediate Actions Required

Upgrade all grist-core deployments to version 1.7.7 or later as published in the v1.7.7 release notes
Inventory documents that use partial read access rules and treat historical version data as potentially exposed until patched
Rotate any secrets, API keys, or credentials that may have been stored in restricted cells within affected documents

Patch Information

Grist Labs released grist-core version 1.7.7, which restricts the /compare endpoint to users with full read access to the target document. Review the GitHub Security Advisory GHSA-3v78-cw58-v685 for the authoritative fix description and upgrade guidance.

Workarounds

Remove sensitive document history using the /states/remove endpoint to purge historical versions containing restricted data
Block the /compare endpoint at a reverse proxy or Web Application Firewall (WAF) layer until the upgrade is applied
Revoke partial read access from users who should not have exposure to the document while planning remediation

bash

# Example reverse-proxy rule to block the /compare endpoint pending upgrade
location ~* ^/api/docs/[^/]+/compare {
    return 403;
}