CVE-2026-53536
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In Activepieces prior to version 0.83.0, the /v1/step-files/signed endpoint did not verify the JWT audience and lacked a null check for decoded fileId. This allowed an authenticated user to retrieve step-files belonging to other tenants on the same instance.
Risk Assessment
The organization is at risk of leaking sensitive data stored in step-file attachments of other tenants. The attacker cannot target a specific victim but may gain access to random files from other users.
Recommendation
Immediately update Activepieces to version 0.83.0 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Activepieces
See all- CVE-2026-48499Critical
In Activepieces before version 0.84.0, an unsanitized path segment in the Code piece sandbox lets an authenticated flow author read and write cached flow and code files belonging to other tenants on the same worker. This can expose embedded data and allow modified code to execute on a victim tenant's next flow run.
- CVE-2026-73084Medium
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0.
- CVE-2026-73083High
Activepieces prior to 0.80.0 in SANDBOX_CODE_ONLY mode loads the user module before applying the V8 isolate, allowing access to Node.js APIs outside the sandbox. An authenticated user can read environment secrets, files, and reach internal services.
- CVE-2026-73082Medium
Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can cause the server to connect to internal services, cloud metadata endpoints, or arbitrary external hosts and probe network reachability. This issue is fixed in version 0.82.0.
- CVE-2026-73081High
Activepieces prior to 0.80.0 has a vulnerability in the code compilation pipeline where a step name can contain shell metacharacters, allowing arbitrary command execution during compilation. An authenticated user can execute commands as the worker process.
- CVE-2026-53535Medium
In Activepieces before version 0.82.0, the git-sync feature allowed writes to escape the intended workspace and land on arbitrary paths on the host filesystem. This was due to Git symbolic-link handling not being disabled and insufficient validation of user-supplied identifiers (repository slug, externalId of tables, flows, connections) against directory-traversal sequences.
Original NVD description (English source)
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the shared signing secret but did not check the token's audience, and combined with a missing null-check on the decoded fileId, this allowed any caller holding any valid Activepieces JWT (including a freshly created user's own access token) to receive a step-file belonging to another tenant. The file returned was whatever PostgreSQL happened to scan first for type = FLOW_STEP_FILE, varying over time as the database changed, so an authenticated user could obtain step-file attachments belonging to other tenants on the same instance; the attacker could not target a specific victim or file, and the access was read-only with no integrity or availability impact. This issue is fixed in version 0.83.0.