CVE-2026-55664: Grist Information Disclosure Vulnerability

CVE-2026-55664 Overview

CVE-2026-55664 is an information disclosure vulnerability in Grist, spreadsheet software that uses Python as its formula language. The flaw affects versions prior to 1.7.15. The GET /forms endpoint reads table and column metadata without enforcing the document's access rules and does not verify that the requested section is a form. A user with partial read access, including public access on a publicly viewable document, can request the metadata of any widget and reveal table and column structure that access rules would otherwise hide. The exposure occurs even in documents that contain no forms. Grist Labs fixed the issue in version 1.7.15.

Critical Impact
Low-privileged or anonymous users on public Grist documents can enumerate hidden table and column schemas protected by access rules, undermining data compartmentalization [CWE-200].

Affected Products

Grist Core versions prior to 1.7.15
Self-hosted Grist deployments exposing the /forms endpoint
Publicly shared Grist documents with partial access rules

Discovery Timeline

2026-07-10 - CVE-2026-55664 published to the National Vulnerability Database
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-55664

Vulnerability Analysis

Grist enforces per-document access rules that determine which tables, columns, and rows each user can read. The GET /forms handler in app/server/lib/DocApi.ts bypasses this authorization layer when fetching widget metadata. Instead of routing metadata reads through the access-rule aware retrieval path, the handler queries raw table and column metadata directly. It also fails to validate that the requested section corresponds to a form widget, allowing the endpoint to return metadata for arbitrary widget types. The result is unauthorized disclosure of schema information, including table names and column structures, that access rules explicitly hide from the caller.

Root Cause

The root cause is missing authorization enforcement on a metadata read path [CWE-200]. The /forms route trusted the requester's document-level read grant and skipped the granular access-rule filtering that other read paths apply. A secondary defect is the absence of a widget-type check, letting non-form widgets be treated as forms.

Attack Vector

An attacker with partial read access, or any anonymous user on a publicly viewable document, sends a crafted GET /forms request referencing a widget section identifier. The server responds with table and column metadata that access rules would otherwise suppress. No authentication or user interaction beyond the standard shared link is required for public documents.

typescript

// Security patch in app/server/lib/DocApi.ts
// (core) Use fetchMetaTables in GET /forms
 } from "app/common/gristTypes";
 import { buildUrlId, parseUrlId, SHARE_KEY_PREFIX } from "app/common/gristUrls";
 import { isAffirmative, safeJsonParse } from "app/common/gutil";
-import { MetaRowRecord } from "app/common/TableData";
+import { schema, SchemaTypes } from "app/common/schema";
+import { MetaRowRecord, MetaTableData } from "app/common/TableData";
 import {
   ArchiveUploadResult,
   CreatableArchiveFormats,
   DocReplacementOptions,
   ExpandTableOption,
   NEW_DOCUMENT_CODE,
 } from "app/common/UserAPI";
+import { WidgetType } from "app/common/widgetTypes";
 import { Document } from "app/gen-server/entity/Document";
 import { Workspace } from "app/gen-server/entity/Workspace";
 import { HomeDBManager, makeDocAuthResult } from "app/gen-server/lib/homedb/HomeDBManager";

Source: GitHub Commit 14694156. The patch introduces fetchMetaTables and a WidgetType check so metadata retrieval respects access rules and verifies the target section is a form.

Detection Methods for CVE-2026-55664

Indicators of Compromise

Unexpected GET /api/docs/<docId>/forms/<sectionId> requests originating from anonymous sessions or low-privilege users.
Requests targeting section identifiers that do not correspond to form widgets in the document.
Bursts of /forms requests iterating through numeric section IDs, indicating enumeration.

Detection Strategies

Review Grist application logs and reverse-proxy access logs for /forms endpoint calls preceding version 1.7.15.
Correlate /forms requests against a document inventory to flag calls on documents that contain no form widgets.
Alert on repeated /forms requests from a single session enumerating section IDs.

Monitoring Recommendations

Enable verbose request logging on the Grist server and forward events to a central log platform.
Track anonymous access to publicly shared documents that have access rules configured.
Baseline normal /forms traffic volumes so that scraping-style access patterns become visible.

How to Mitigate CVE-2026-55664

Immediate Actions Required

Upgrade all Grist deployments to version 1.7.15 or later.
Audit publicly shared documents and rotate share keys for documents that rely on access rules for schema confidentiality.
Review access rule configurations to confirm that no additional endpoints leak metadata outside the rule scope.

Patch Information

Grist Labs released the fix in Grist v1.7.15. Technical details and remediation guidance are documented in the GHSA-w2hc-w6cg-xvh9 advisory. The fix routes GET /forms through fetchMetaTables so document access rules are applied, and it validates that the referenced widget is a WidgetType.Form.

Workarounds

Restrict public sharing on documents whose table or column names are considered sensitive until the upgrade is applied.
Block or rate-limit /forms requests at a reverse proxy for anonymous or low-privilege sessions.
Remove access-rule based confidentiality assumptions for documents that must remain publicly accessible on unpatched versions.

bash

# Verify the running Grist version and upgrade using Docker
docker inspect grist --format '{{ .Config.Image }}'
docker pull gristlabs/grist:1.7.15
docker stop grist && docker rm grist
docker run -d --name grist -p 8484:8484 \
  -v /srv/grist:/persist \
  gristlabs/grist:1.7.15